HighFix available
node-sqlite3 — security advisory
The package sqlite3 before 5.0.3 are vulnerable to Denial of Service (DoS) which will invoke the toString function of the passed parameter. If passed an invalid Function object it will throw and crash the V8 engine.
- Products
- node-sqlite3
- Affected versions
- Not specified
- Fixed versions
- 5.0.6+ds1-1
- CVEs
- CVE-2022-21227
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 14:36 UTC · Revision 1
Source evidence
The package sqlite3 before 5.0.3 are vulnerable to Denial of Service (DoS) which will invoke the toString function of the passed parameter. If passed an invalid Function object it will throw and crash the V8 engine.
osv:DEBIAN-CVE-2022-21227
node-sqlite3
Fixed versions: 5.0.6+ds1-1
node-sqlite3
Fixed versions: 5.0.6+ds1-1
node-sqlite3
Fixed versions: 5.0.6+ds1-1
Complete source record
{
"id": "862f52378686dcedab19805041db783924f1b85c2dbcbe0608a2a615a915f1d8",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2022-21227",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2022-21227",
"summary": "The package sqlite3 before 5.0.3 are vulnerable to Denial of Service (DoS) which will invoke the toString function of the passed parameter. If passed an invalid Function object it will throw and crash the V8 engine.",
"evidence": "osv:DEBIAN-CVE-2022-21227",
"products": [
{
"name": {
"value": "node-sqlite3",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.0.6+ds1-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "node-sqlite3",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.0.6+ds1-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "node-sqlite3",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.0.6+ds1-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "DEBIAN-CVE-2022-21227",
"aliases": [
"DEBIAN-CVE-2022-21227"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.6+ds1-1"
}
]
}
],
"package": {
"name": "node-sqlite3",
"purl": "pkg:deb/debian/node-sqlite3?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-21227.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.6+ds1-1"
}
]
}
],
"package": {
"name": "node-sqlite3",
"purl": "pkg:deb/debian/node-sqlite3?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-21227.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.6+ds1-1"
}
]
}
],
"package": {
"name": "node-sqlite3",
"purl": "pkg:deb/debian/node-sqlite3?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-21227.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-15T08:01:01.180852359Z",
"provider": "osv",
"upstream": [
"CVE-2022-21227"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2022-21227"
]
},
"related_cves": [
{
"value": "CVE-2022-21227",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 322754,
"published_at": "2022-05-01T16:15:08.197+00:00"
}