Executive brief
libpq and pg-native are Node.js bindings to PostgreSQL client libraries used by applications to connect to and query databases. A vulnerability in array casting logic can be exploited to cause a denial-of-service condition, disrupting database connectivity and availability for any application relying on these libraries to access its data.
Technical details
The vulnerability is an uncontrolled resource consumption flaw (CWE-400, CWE-704) in libpq and pg-native's array casting logic. When these libraries attempt to cast a non-array argument to an array type, the operation fails in a manner that triggers excessive resource consumption, leading to denial of service. An attacker with network access can trigger this by passing non-array arguments through database queries or connection parameters. No authentication is required. Patches are available: libpq 1.8.10 and pg-native 3.0.1 fix the issue.
Affected products
- npm libpq < 1.8.10
- npm pg-native < 3.0.1
Timeline
- 2022-06-17: disclosed: CVE-2022-25852 published on NVD
- 2022-06-18: advisory: GHSA-j32j-2hxv-rqf7 published
- 2022-06-20: patched: libpq 1.8.10 and pg-native 3.0.1 released with fix