# CVE-2022-25885: muhammara and hummus null pointer dereference in PDFStreamForResponse

Source: https://junglewise.ai/threats/cve-2022-25885-muhammara-and-hummus-null-pointer-dereference-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-11-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-25885 · Severity: low · CVSS 3.1 · Published 2022-11-01

muhammara and hummus are JavaScript libraries used to create and manipulate PDF documents. Both libraries crash with a denial of service when the PDFStreamForResponse function is passed invalid or null input, causing the application to terminate unexpectedly and disrupting service availability.

Technologies: [hummus (npm)](https://junglewise.ai/threats/technologies/hummus), [muhammara (npm)](https://junglewise.ai/threats/technologies/muhammara). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-25885 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-25885 being exploited in the wild.

**How severe is CVE-2022-25885?** Low severity, with a CVSS score of 3.1, published 1 November 2022.

**Which products and versions are affected?** Galkahana HummusJS before 1.0.111; Julian Hille MuhammaraJS before 2.6.0; hummus (npm) SEMVER:introduced=1.0.0,fixed=1.0.111; muhammara (npm) SEMVER:introduced=0,fixed=2.6.0.

**Is there a fix for CVE-2022-25885?** Yes. hummus (npm): upgrade to 1.0.111 or later; muhammara (npm): upgrade to 2.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-25885 attacked?** It is attacked over the network.

**Am I affected by CVE-2022-25885?** Check whether you run Galkahana HummusJS, Julian Hille MuhammaraJS, hummus (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- hummus (npm): upgrade to 1.0.111 or later

  ```sh
  npm install hummus@1.0.111
  ```

- muhammara (npm): upgrade to 2.6.0 or later

  ```sh
  npm install muhammara@2.6.0
  ```


## Technical details

The vulnerability is a null pointer dereference (CWE-690) in the PDFStreamForResponse() function that fails to validate input parameters. When invalid data (including null values) is passed to PDFStreamForResponse, the library attempts to dereference a null pointer while writing PDF headers, causing an application crash. No authentication or special privileges are required; the vulnerability can be triggered by any code path that calls PDFStreamForResponse with malformed input. An attacker can cause a denial of service by crafting a request that leads to the vulnerable function being called with bad data. Patches are available in muhammara version 2.6.0 and hummus version 1.0.111.

## Affected products

- Galkahana HummusJS before 1.0.111
- Julian Hille MuhammaraJS before 2.6.0

## Identifiers

- CVE-2022-25885
- GHSA-frp9-2v6r-gj97

## Timeline

- 2022-11-01: disclosed: Published in GitHub Advisory Database
- 2022-11-01: patched: Hummus 1.0.111 and muhammara 2.6.0 released with fixes

## References

- [https://github.com/galkahana/HummusJS/issues/439](https://github.com/galkahana/HummusJS/issues/439)

## Related threats

- [Muhammara NULL pointer dereference in LZWDecode filter](https://junglewise.ai/threats/muhammara-null-pointer-dereference-in-lzwdecode-filter-ec14f183)
- [Muhammara null pointer dereference in PDF append](https://junglewise.ai/threats/cve-2022-39381-muhammara-null-pointer-dereference-in-pdf-append)
- [muhammara and Hummus NULL pointer dereference denial of service](https://junglewise.ai/threats/cve-2022-25892-muhammara-and-hummus-null-pointer-dereference-denial-of-service)