{"id":"EUVD-2022-6377","revision":"481bb4559e6d45ebbc227402127d25d7","records":[{"revision":"481bb4559e6d45ebbc227402127d25d7","observedAt":"2026-10-30T20:49:03.902+00:00","statement":{"source":"euvd","id":"EUVD-2022-6377","aliases":["CVE-2022-36313","GHSA-mhxj-85r3-2x55"],"title":"An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsiv…","description":"An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","score":5.5,"severity":null}],"references":["https://www.npmjs.com/package/file-type","https://github.com/sindresorhus/file-type/releases/tag/v17.1.3","https://github.com/sindresorhus/file-type/releases/tag/v16.5.4","https://security.netapp.com/advisory/ntap-20220909-0005/"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6377","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 21, 2022, 3:31:27 PM","dateUpdated":"Oct 7, 2026, 6:50:18 PM"},"relatedAdvisories":[{"id":"RHSA-2023:0713","title":"Red Hat Security Advisory: Red Hat Data Grid 8.4.1 security update","vulnerabilityIds":["CVE-2022-36313","CVE-2022-37603","CVE-2022-41881","CVE-2022-42003","CVE-2022-42004","CVE-2022-45047"]},{"id":"WID-SEC-W-2022-0800","title":"Node.js: Schwachstelle ermöglicht Denial of Service","vulnerabilityIds":["CVE-2022-36313"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2022-6377","identifiers":["EUVD-2022-6377","CVE-2022-36313","GHSA-mhxj-85r3-2x55"]},"retained":false,"historicalAffected":[]}],"coverage":[]}