npm mongodb-client-encryption vulnerabilities

Latest npm mongodb-client-encryption CVEs

Newest publication first

1. CVE-2021-20327 MongoDB Node.js client side field level encryption library may not be validating KMS certificate

   Published 2021-02-25

   Medium·CVSS 6.8 EPSS 0.20%

   A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.