# CVE-2022-25892: muhammara and Hummus NULL pointer dereference denial of service

Source: https://junglewise.ai/threats/cve-2022-25892-muhammara-and-hummus-null-pointer-dereference-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-11-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-25892 · Severity: low · CVSS 3.1 · Published 2022-11-01

muhammara and Hummus are popular JavaScript libraries used to parse and manipulate PDF files. A vulnerability in how these libraries handle maliciously crafted PDF files can cause them to crash due to a null pointer error, resulting in denial of service. Applications relying on these libraries to process PDFs—particularly from untrusted sources—could become unavailable when processing a specially crafted malicious PDF.

Technologies: [hummus (npm)](https://junglewise.ai/threats/technologies/hummus), [muhammara (npm)](https://junglewise.ai/threats/technologies/muhammara). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-25892 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-25892 being exploited in the wild.

**How severe is CVE-2022-25892?** Low severity, with a CVSS score of 3.1, published 1 November 2022.

**Which products and versions are affected?** hummus (npm) SEMVER:introduced=0,fixed=1.0.111; muhammara (npm) SEMVER:introduced=0,fixed=2.6.1.

**Is there a fix for CVE-2022-25892?** Yes. hummus (npm): upgrade to 1.0.111 or later; muhammara (npm): upgrade to 2.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-25892 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-25892?** Check whether you run hummus (npm) or muhammara (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- hummus (npm): upgrade to 1.0.111 or later

  ```sh
  npm install hummus@1.0.111
  ```

- muhammara (npm): upgrade to 2.6.1 or later

  ```sh
  npm install muhammara@2.6.1
  ```


## Technical details

The vulnerability is a NULL pointer dereference (CWE-690) triggered by incomplete error handling in PDF parsing logic. When a maliciously crafted PDF file is supplied to either muhammara or Hummus, a function call can return NULL on error, but the library does not validate this return value before dereferencing it. This causes the application to crash with an uncaught null pointer exception. The attack requires only network access and no authentication or user interaction—an attacker can remotely trigger the crash by submitting a malicious PDF to any application using these libraries to process untrusted input. Patches are available: muhammara 2.6.1 and 3.1.1, and Hummus 1.0.111.

## Affected products

- Julian Hille muhammara before 2.6.1, 3.0.0 to before 3.1.1
- Gal Kahana Hummus all versions before 1.0.111

## Identifiers

- CVE-2022-25892
- GHSA-9cv5-4wqv-9w94

## Timeline

- 2022-11-01: disclosed
- 2022-11-01: patched: muhammara patched in 2.6.1 and 3.1.1; Hummus patched in 1.0.111

## References

- [https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-f64j-4x74-p42m](https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-f64j-4x74-p42m)

## Related threats

- [Muhammara NULL pointer dereference in LZWDecode filter](https://junglewise.ai/threats/muhammara-null-pointer-dereference-in-lzwdecode-filter-ec14f183)
- [Muhammara null pointer dereference in PDF append](https://junglewise.ai/threats/cve-2022-39381-muhammara-null-pointer-dereference-in-pdf-append)
- [muhammara and hummus null pointer dereference in PDFStreamForResponse](https://junglewise.ai/threats/cve-2022-25885-muhammara-and-hummus-null-pointer-dereference-in)