TI-2022-05619 Aliases CVE-2022-21227 GHSA-9qrh-qjmc-5w2p

Denial of service (DoS) in sqlite3

LOW 37CWE-248Published 2022-05-01 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-248.

Summary

The package sqlite3 before 5.0.3 are vulnerable to Denial of Service (DoS) which will invoke the toString function of the passed parameter. If passed an invalid Function object it will throw and crash the V8 engine.

Why it matters now

EPSS 0.02213 82nd percentileScored 2026-11-07

Fix Fixed sqlite3: 5.0.3sqlite3 (npm): 5.0.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	sqlite3	before 5.0.3	5.0.3	Patch available	CNA
—	sqlite3 (npm)	5.0.0 to before 5.0.3	5.0.3	Patch available	GHSA-9qrh-qjmc-5w2p

sqlite3 Vendor— Affected before 5.0.3 Fixed in 5.0.3 Patch available CNA
sqlite3 (npm) Vendor— Affected 5.0.0 to before 5.0.3 Fixed in 5.0.3 Patch available GHSA-9qrh-qjmc-5w2p

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:ghost:sqlite3::::::node.js::*	before 5.0.3	Vulnerable	TryGhost

cpe:2.3:a:ghost:sqlite3:*:*:*:*:*:node.js:*:* Versions before 5.0.3 Vulnerable ·TryGhost

Remediation

Fix · CNA sqlite3 Fixed in 5.0.3
Fix · GHSA-9qrh-qjmc-5w2p sqlite3 (npm) Fixed in 5.0.3 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 4 products

Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9

Timeline

2026-10-02 Threatist record created from CVE-2022-21227
2026-10-03 Alias added: GHSA-9qrh-qjmc-5w2p

References

Patch 1

https://github.com/TryGhost/node-sqlite3/commit/593c9d498be2510d286349134537e3bf89401c4a

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2022-21227

Other 4

TI-2022-21236 Mass assignment in TryGhost node-sqlite3 CVSS 3.1CRITICAL 9.8
TI-2020-15181 Buffer Overflow vulnerability found in SQLite3 v.3.27.1 and before allows a local… CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences