{"id":"GHSA-27wq-qx3q-fxm9","summary":"Improper Handling of Unexpected Data Type in ced","details":"### Impact\n\nIn ced v0.1.0, passing data types other than `Buffer` causes the Node.js process to crash.\n\n### Patches\n\nThe problem has been patched in [ced v1.0.0](https://github.com/sonicdoe/ced/releases/tag/v1.0.0). You can upgrade from v0.1.0 without any breaking changes.\n\n### Workarounds\n\nBefore passing an argument to ced, verify it’s a `Buffer` using [`Buffer.isBuffer(obj)`](https://nodejs.org/api/buffer.html#buffer_static_method_buffer_isbuffer_obj).\n\n### CVSS score\n\n[CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/RL:O/RC:C](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/RL:O/RC:C)\n\nBase Score: 7.5 (High)\nTemporal Score: 7.2 (High)\n\nSince ced is a library, the scoring is based on the “[reasonable worst-case implementation scenario](https://www.first.org/cvss/v3.1/user-guide#3-7-Scoring-Vulnerabilities-in-Software-Libraries-and-Similar)”, namely, accepting data from untrusted sources over a network and passing it directly to ced. Depending on your specific implementation, the vulnerability’s severity in your program may be different.\n\n### Proof of concept\n\n```js\nconst express = require(\"express\");\nconst bodyParser = require(\"body-parser\");\nconst ced = require(\"ced\");\n\nconst app = express();\n\napp.use(bodyParser.raw());\n\napp.post(\"/\", (req, res) =\u003e {\n  const encoding = ced(req.body);\n\n  res.end(encoding);\n});\n\napp.listen(3000);\n```\n\n`curl --request POST --header \"Content-Type: text/plain\" --data foo http://localhost:3000` crashes the server.\n\n### References\n\n- https://github.com/sonicdoe/ced/commit/a4d9f10b6bf1cd468d1a5b9a283cdf437f8bb7b3","aliases":["CVE-2021-39131"],"modified":"2026-05-13T12:14:13.098396728Z","published":"2021-08-23T19:42:28Z","database_specific":{"github_reviewed_at":"2021-08-23T17:18:32Z","nvd_published_at":"2021-08-17T23:15:00Z","cwe_ids":["CWE-241"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/sonicdoe/ced/security/advisories/GHSA-27wq-qx3q-fxm9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39131"},{"type":"WEB","url":"https://github.com/sonicdoe/ced/commit/a4d9f10b6bf1cd468d1a5b9a283cdf437f8bb7b3"},{"type":"PACKAGE","url":"https://github.com/sonicdoe/ced"},{"type":"WEB","url":"https://github.com/sonicdoe/ced/releases/tag/v1.0.0"}],"affected":[{"package":{"name":"ced","ecosystem":"npm","purl":"pkg:npm/ced"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/08/GHSA-27wq-qx3q-fxm9/GHSA-27wq-qx3q-fxm9.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}