Denial of Service (DoS)

published 2022-06-17 4 y ago modified 2026-06-17 4 mo ago also GHSA-j32j-2hxv-rqf7 , EUVD-2022-6074

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.4%; EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits: 0; none known

All versions of package pg-native; all versions of package libpq are vulnerable to Denial of Service (DoS) when the addons attempt to cast the second argument to an array and fail. This happens for every non-array argument passed. **Note:** pg-native is a mere binding to npm's libpq library, which in turn has the addons and bindings to the actual C libpq library. This means that problems found in pg-native may transitively impact npm's libpq.

Patch / fix

fixed in 2 links 1

npm libpq 1.8.10
npm pg-native 3.0.1

github.com/brianc/node-libpq#86 pull request

Exploit prediction

1.40% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

snyk.io https://snyk.io/vuln/SNYK-JS-PGNATIVE-2392365 referenced PoC, tagged "exploit" by a source, unverified
snyk.io https://snyk.io/vuln/SNYK-JS-LIBPQ-2392366 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:N/A:P
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
npm	libpq	<1.8.10	1.8.10
npm	pg-native	<3.0.1	3.0.1

Affected products

n/a pg-native
n/a libpq

Classification

Weakness

CWE-704 Incorrect Type Conversion or Cast
CWE-400 Uncontrolled Resource Consumption

References

github.com /brianc/node-libpq/pull/86
web
snyk.io /vuln/SNYK-JS-PGNATIVE-2392365
web, exploit, third-party-advisory
snyk.io /vuln/SNYK-JS-LIBPQ-2392366
web, exploit, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2022-25852
advisory
github.com /brianc/node-libpq/issues/84
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary