What’s Vulnerable › Vulnerabilities

CVE-2022-39381: Unchecked Return Value to NULL Pointer Dereference in PDFDocumentHandler.cpp

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-11-02 · updated 2026-06-17
• Weakness: CWE-690

Description

Muhammara is a node module with c/cpp bindings to modify PDF with js for node or electron (based/replacement on/of galkhana/hummusjs). The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be appended to another. This issue has been patched in 2.6.0 for muhammara and not at all for hummus. As a workaround, do not process files from untrusted sources.

Affected products

• Muhammarajs Project Muhammarajs: through 2.6.0
• Pdfhummus Hummusjs: before 1.0.111 — fixed in 1.0.111

How to fix

Upgrade to a fixed version: Pdfhummus Hummusjs 1.0.111. Check the vendor advisory for mitigations.

References

• https://github.com/galkahana/HummusJS/issues/293
• https://github.com/julianhille/MuhammaraJS/issues/191
• https://github.com/julianhille/MuhammaraJS/pull/194
• https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-rcrx-fpjp-mfrw
• https://github.com/galkahana/HummusJS/issues/293
• https://github.com/julianhille/MuhammaraJS/issues/191
• https://github.com/julianhille/MuhammaraJS/pull/194
• https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-rcrx-fpjp-mfrw

Get alerted when CVE-2022-39381 or the next vulnerability affects your stack