# CVE-2022-41957: Muhammara and Hummus NULL pointer dereference in PDF parser

Source: https://junglewise.ai/threats/cve-2022-41957-muhammara-and-hummus-null-pointer-dereference-in-pdf-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-12-05. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2022-41957 · Severity: low · CVSS 3.1 · Published 2022-12-05

The muhammara and hummus libraries, which are used to create and modify PDF files in Node.js applications, are vulnerable to a denial-of-service flaw. An attacker can provide a specially crafted PDF file that, when processed by the library, causes the application to crash. This can lead to service outages and impact the availability of applications that handle user-uploaded PDF documents.

## Quick answers

**Is CVE-2022-41957 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-41957 being exploited in the wild.

**How severe is CVE-2022-41957?** Low severity, with a CVSS score of 3.1, published 5 December 2022.

**Which products and versions are affected?** julianhille muhammara < 2.6.2, >= 3.0.0 < 3.4.0; galkhana hummus All versions.

**Is there a fix for CVE-2022-41957?** A patch was published on 2022-11-24: Fixes merged into muhammara repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-41957 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-41957?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A NULL pointer dereference vulnerability exists in the muhammara and hummus Node.js packages due to unchecked return values in the underlying C++ PDF parsing logic. Specifically, functions such as GetGlyphCharString, QueryObject, and GetPageTreeChild can return NULL when processing malformed PDF data; if these returns are not validated, the application attempts to dereference the pointer, resulting in a segmentation fault and process crash. The vulnerability can be triggered remotely if the application processes untrusted PDF files. The issue is patched in muhammara versions 2.6.2 and 3.4.0. The hummus package is deprecated and remains vulnerable; users are advised to migrate to muhammara.

## Affected products

- julianhille muhammara < 2.6.2, >= 3.0.0 < 3.4.0
- galkhana hummus All versions

## Identifiers

- CVE-2022-41957
- GHSA-2r7v-cmch-5x26

## Timeline

- 2022-11-28: advisory: NVD published CVE-2022-41957
- 2022-12-05: disclosed: GitHub Advisory published
- 2022-11-24: patched: Fixes merged into muhammara repository

## References

- [https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-2r7v-cmch-5x26](https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-2r7v-cmch-5x26)
- [https://github.com/julianhille/MuhammaraJS/pull/235](https://github.com/julianhille/MuhammaraJS/pull/235)
- [https://github.com/julianhille/MuhammaraJS/pull/238](https://github.com/julianhille/MuhammaraJS/pull/238)
- [https://github.com/julianhille/MuhammaraJS](https://github.com/julianhille/MuhammaraJS)