{"id":"EUVD-2022-6377","enisaUuid":"e2ce799c-d14b-32b1-b55d-4f496059e1ca","description":"An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack.","datePublished":"Jul 21, 2022, 3:31:27 PM","dateUpdated":"Oct 7, 2026, 6:50:18 PM","baseScore":5.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","references":"https://www.npmjs.com/package/file-type\nhttps://github.com/sindresorhus/file-type/releases/tag/v17.1.3\nhttps://github.com/sindresorhus/file-type/releases/tag/v16.5.4\nhttps://security.netapp.com/advisory/ntap-20220909-0005/\n","aliases":"CVE-2022-36313\nGHSA-mhxj-85r3-2x55\n","assigner":"mitre","epss":0.41,"enisaIdProduct":[{"id":"26aefb00-1c86-3431-be9b-fecda67b6851","product":{"name":"n/a","vendor":{"name":"n/a"}},"product_version":"n/a"}],"enisaIdVendor":[{"id":"3d422629-e9d1-30ef-96eb-46ec1fb720c9","vendor":{"name":"n/a"}}],"enisaIdVulnerability":[{"id":"868feff0-4bdd-3071-b8db-736da9dada95","vulnerability":{"id":"GHSA-mhxj-85r3-2x55","description":"file-type vulnerable to Infinite Loop via malformed MKV file","datePublished":"Jul 22, 2022, 12:00:38 AM","dateUpdated":"Aug 16, 2022, 3:42:27 PM","baseScore":null,"references":"https://nvd.nist.gov/vuln/detail/CVE-2022-36313\nhttps://github.com/sindresorhus/file-type/commit/2c4d1200c99dffb7d515b9b9951ef43c22bf7e47\nhttps://github.com/sindresorhus/file-type/commit/8f981c32e2750d2516457e305e502ee2ad715759#diff-c853b2249e99790d8725774cf63c90c5ab17112067df6e267f3701d7bf591d12\nhttps://github.com/sindresorhus/file-type/commit/d86835680f4cccbee1a60628783c36700ec9e254\nhttps://github.com/sindresorhus/file-type\nhttps://github.com/sindresorhus/file-type/compare/v12.4.2...v13.0.0#diff-c853b2249e99790d8725774cf63c90c5ab17112067df6e267f3701d7bf591d12R611-R613\nhttps://github.com/sindresorhus/file-type/releases/tag/v16.5.4\nhttps://github.com/sindresorhus/file-type/releases/tag/v17.1.3\nhttps://security.netapp.com/advisory/ntap-20220909-0005\nhttps://security.snyk.io/vuln/SNYK-JS-FILETYPE-2958042\nhttps://www.npmjs.com/package/file-type\n","enisa_id":"EUVD-2022-6377\n","aliases":"GHSA-mhxj-85r3-2x55\nCVE-2022-36313\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:27:56 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e788d130-f917-314f-a53a-928a3296cd0a","vulnerability":{"id":"CVE-2022-36313","description":"An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack.","datePublished":"Jul 21, 2022, 3:31:27 PM","dateUpdated":"Oct 7, 2026, 6:50:18 PM","status":"PUBLISHED","baseScore":5.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","references":"https://www.npmjs.com/package/file-type\nhttps://github.com/sindresorhus/file-type/releases/tag/v17.1.3\nhttps://github.com/sindresorhus/file-type/releases/tag/v16.5.4\nhttps://security.netapp.com/advisory/ntap-20220909-0005/\n","enisa_id":"EUVD-2022-6377\n","assigner":"mitre","epss":0.41,"dataProcessed":"Nov 9, 2026, 7:13:49 AM","vulnerabilityProduct":[{"id":"3c2355a9-abeb-3452-9641-d406139f8adb","product":{"name":"n/a","vendor":{"name":"n/a"}},"product_version":"n/a"}],"vulnerabilityVendor":[{"id":"17bec3fb-7a74-3343-9f4a-21f0558e7a58","vendor":{"name":"n/a"}}]}}],"enisaIdAdvisory":[{"id":"7044c1f2-a093-3dae-b074-b4565a5a5481","advisory":{"id":"RHSA-2023:0713","description":"Red Hat Security Advisory: Red Hat Data Grid 8.4.1 security update","summary":"An update for Red Hat Data Grid 8 is now available.\n \nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.","datePublished":"Feb 9, 2023, 11:35:44 AM","dateUpdated":"Nov 7, 2026, 5:34:32 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2023:0713\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0713.json\n","aliases":"CVE-2022-36313\nCVE-2022-37603\nCVE-2022-41881\nCVE-2022-42003\nCVE-2022-42004\nCVE-2022-45047\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"fc0aa57f-5ec2-326c-9701-7ade20bae014","product":{"name":"Red Hat Data Grid 8.4.1","vendor":{"name":"Red Hat"}}}]}},{"id":"785a738f-1f12-397c-9d92-c6d6eae25f57","advisory":{"id":"WID-SEC-W-2022-0800","description":"Node.js: Schwachstelle ermöglicht Denial of Service","summary":"Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Node.js ausnutzen, um einen Denial of Service Angriff durchzuführen.","datePublished":"Jul 21, 2022, 10:00:00 PM","dateUpdated":"Feb 9, 2023, 11:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-0800.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2022-0800\n","aliases":"CVE-2022-36313\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"270687bb-e7f8-3ab0-a970-59877d7b8935","product":{"name":"Open Source Node.js \u003c 17.1.3","vendor":{"name":"open source"}}},{"id":"32156ff4-4f06-3a79-abb9-3e2e63816d99","product":{"name":"Node.js","vendor":{"name":"Node.js"}}},{"id":"61812c1c-7076-3f3e-b1b6-1d59b6f668ac","product":{"name":"Open Source Node.js \u003c 16.5.4","vendor":{"name":"open source"}}},{"id":"783fe69e-b4d6-3a43-b676-c9b43b1f02f4","product":{"name":"Red Hat Enterprise Linux","vendor":{"name":"Red Hat"}}}]}}]}