Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.3
CVE-2025-4727: Meteor up to 3.2.1 can be slowed by remote request
CVE-2025-4727 · published 1 year ago
Summary
The Meteor web framework (versions up to 3.2.1) has a piece of code that can be tricked into doing a lot of work, making the server respond slowly. An attacker on the internet could send specially crafted data to cause this slowdown, affecting the performance of your application. Update Meteor to version 3.2.2 or later to stop the problem.
What to do
- Update meteor meteor to version 3.2.2 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | gywem | meteor | <= 3.2.1 |
| – | meteor | meteor |
< 3.2.2 cpe:2.3:a:meteor:meteor:*:*:*:*:*:*:*:* |
Original advisory text
Meteor livedata_server.js Object.assign redos
A vulnerability was found in Meteor up to 3.2.1 and classified as problematic. This issue affects the function Object.assign of the file packages/ddp-server/livedata_server.js. The manipulation of the argument forwardedFor leads to inefficient regular expression complexity. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 3.2.2 is able to address this issue. The identifier of the patch is f7ea6817b90952baaea9baace2a3b4366fee6a63. It is recommended to upgrade the affected component.
References
- https://github.com/advisories/GHSA-j3v9-6gc7-vf5f
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/4xxx/CVE-2025-4727.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-4727 Vendor Advisory
- https://vuldb.com/?id.309029 Vendor Advisory
- https://vuldb.com/?submit.570441 Vendor Advisory
- https://github.com/meteor/meteor/issues/13713 Third Party Advisory
- https://github.com/meteor/meteor/pull/13721 Third Party Advisory
- https://vuldb.com/?ctiid.309029 Third Party Advisory
- https://github.com/meteor/meteor/commit/f7ea6817b90952baaea9baace2a3b4366fee6a63 Patch
- https://github.com/meteor/meteor/releases/tag/release/METEOR%403.2.2 Patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.3
High
Type
CWE-400Uncontrolled Resource Consumption
CWE-1333Inefficient Regular Expression Complexity (ReDoS)
Timeline
Published15 May 2025
Updated3 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta