What is CVE-2022-25892?

CVE-2022-25892 is a high-severity security vulnerability in muhammara (npm), affecting versions < 2.6.1. It is fixed in 2.6.1, 3.1.1, 1.0.111.

How severe is CVE-2022-25892?

CVE-2022-25892 has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.

Which packages are affected by CVE-2022-25892?

muhammara (npm) versions < 2.6.1; hummus (npm) versions < 1.0.111.

Is there a fix for CVE-2022-25892?

Yes. CVE-2022-25892 is fixed in 2.6.1, 3.1.1, 1.0.111. Upgrade to this version or later.

Is CVE-2022-25892 exploitable, and should I be worried?

Whether CVE-2022-25892 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether CVE-2022-25892 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

How do I fix CVE-2022-25892?

Upgrade: muhammara to 2.6.1 or later, muhammara to 3.1.1 or later, hummus to 1.0.111 or later.

CVE-2022-25892 in muhammara

Q: How severe is CVE-2022-25892?

CVE-2022-25892 has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.

Q: Which packages are affected by CVE-2022-25892?

muhammara (npm) versions < 2.6.1; hummus (npm) versions < 1.0.111.

Q: Is there a fix for CVE-2022-25892?

Yes. CVE-2022-25892 is fixed in 2.6.1, 3.1.1, 1.0.111. Upgrade to this version or later.

Q: Is CVE-2022-25892 exploitable, and should I be worried?

Whether CVE-2022-25892 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether CVE-2022-25892 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix CVE-2022-25892?

Upgrade: muhammara to 2.6.1 or later, muhammara to 3.1.1 or later, hummus to 1.0.111 or later.

Summary

muhammara and hummus vulnerable to denial of service by NULL pointer dereference

Workarounds

Do not process files from untrusted sources or update.

References

https://nvd.nist.gov/vuln/detail/CVE-2022-25892
https://github.com/galkahana/HummusJS/issues/463
https://github.com/julianhille/MuhammaraJS/issues/214
https://github.com/julianhille/MuhammaraJS/commit/1890fb555eaf171db79b73fdc3ea543bbd63c002
https://github.com/julianhille/MuhammaraJS/commit/90b278d09f16062d93a4160ef0a54d449d739c51
https://security.snyk.io/vuln/SNYK-JS-HUMMUS-3091138
https://security.snyk.io/vuln/SNYK-JS-MUHAMMARA-3060320

Impact

The package muhammara before 2.6.1, from 3.0.0 and before 3.1.1; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed.

CVE-2022-25892 has a CVSS score of 7.5 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (2.6.1, 3.1.1, 1.0.111); upgrading removes the vulnerable code path.

Affected versions

muhammara (< 2.6.1) muhammara (>= 3.0.0, < 3.1.1) hummus (< 1.0.111)

Security releases

muhammara → 2.6.1 (npm) muhammara → 3.1.1 (npm) hummus → 1.0.111 (npm)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

It has been patched in 3.1.1 and has been backported to 2.6.1
Hummus has a patch in 1.0.111.

Frequently Asked Questions

What is CVE-2022-25892? CVE-2022-25892 is a high-severity security vulnerability in muhammara (npm), affecting versions < 2.6.1. It is fixed in 2.6.1, 3.1.1, 1.0.111.
How severe is CVE-2022-25892? CVE-2022-25892 has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
Which packages are affected by CVE-2022-25892?
- muhammara (npm) (versions < 2.6.1)
- hummus (npm) (versions < 1.0.111)
Is there a fix for CVE-2022-25892? Yes. CVE-2022-25892 is fixed in 2.6.1, 3.1.1, 1.0.111. Upgrade to this version or later.
Is CVE-2022-25892 exploitable, and should I be worried? Whether CVE-2022-25892 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether CVE-2022-25892 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix CVE-2022-25892?
- Upgrade muhammara to 2.6.1 or later
- Upgrade muhammara to 3.1.1 or later
- Upgrade hummus to 1.0.111 or later

Other vulnerabilities in muhammara

CVE-IDSeverityPackage summary

GHSA-FHP4-PR5J-46M5Highmuhammara: Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key CVE-2022-41957Highhummus: muhammara and hummus vulnerable to Unchecked Return Value to NULL Pointer Dereference CVE-2022-39381Highmuhammara: Unchecked Return Value to NULL Pointer Dereference in PDFDocumentHandler.cpp CVE-2022-25885Highmuhammara: muhammara and hummus vulnerable to null pointer dereference on bad response object