PT-2025-21583 · Meteor · Meteor

Dayshift · Published 2025-05-15 · Updated 2025-05-16 · CVE-2025-4727

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: Meteor versions up to 3.2.1

Description: A vulnerability was found in the function Object.assign of the file packages/ddp-server/livedata server.js. The manipulation of the argument forwardedFor leads to inefficient regular expression complexity. The attack may be initiated remotely. The complexity of an attack is rather high, and the exploitation is known to be difficult.

Recommendations: For versions up to 3.2.1, upgrade to version 3.2.2 to address this issue. As a temporary workaround, consider restricting the use of the Object.assign function in the livedata server.js file until the upgrade is applied.

Exploit

Fix

Resource Exhaustion

DoS

Weakness Enumeration

CWE-400

CWE-1333

Related Identifiers

CVE-2025-4727

GHSA-J3V9-6GC7-VF5F

Affected Products

Meteor

References · 13

• 🔥 https://vuldb.com/?submit.570441 · Exploit
• https://github.com/meteor/meteor/pull/13721 · Patch
• https://github.com/meteor/meteor/commit/f7ea6817b90952baaea9baace2a3b4366fee6a63 · Patch
• https://github.com/meteor/meteor/releases/tag/release/METEOR%403.2.2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-4727 · Security Note
• https://osv.dev/vulnerability/GHSA-j3v9-6gc7-vf5f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-4727 · Vendor Advisory
• https://github.com/meteor/meteor · Note
• https://github.com/meteor/meteor/issues/13713 · Note
• https://t.me/cvetracker/23964 · Telegram Post
• https://vuldb.com/?ctiid.309029 · Note
• https://twitter.com/CVEnew/status/1923235069201678594 · Twitter Post
• https://vuldb.com/?id.309029 · Note