CVE-2021-31875

In mjs_json.c in Cesanta MongooseOS mJS 1.26, a maliciously formed JSON string can trigger an off-by-one heap-based buffer overflow in mjs_json_parse, which can potentially lead to redirection of control flow. NOTE: the original reporter disputes the significance of this finding because "there isn’t very much of an opportunity to exploit this reliably for an information leak, so there isn’t any real security impact."

• CWE-193
• CWE-787

• https://github.com/418sec/mjs/pull/2Patch, Third Party Advisory
• https://github.com/cesanta/mjs/releases/tag/1.26Release Notes, Third Party Advisory
• https://huntr.dev/bounties/1-other-mjs/Exploit, Third Party Advisory
• https://github.com/418sec/mjs/pull/2Patch, Third Party Advisory
• https://github.com/cesanta/mjs/releases/tag/1.26Release Notes, Third Party Advisory
• https://huntr.dev/bounties/1-other-mjs/Exploit, Third Party Advisory

Published

Apr 29, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-3187An issue was discovered in BeyondTrust Privilege Management …8.8
• CVE-2021-31870An issue was discovered in klibc before 2.0.9. Multiplicatio…9.8
• CVE-2021-31871An issue was discovered in klibc before 2.0.9. An integer ov…7.5
• CVE-2021-31872An issue was discovered in klibc before 2.0.9. Multiple poss…9.8
• CVE-2021-31873An issue was discovered in klibc before 2.0.9. Additions in …9.8
• CVE-2021-31874Zoho ManageEngine ADSelfService Plus before 6104, in rare si…5.9
• CVE-2021-31876Bitcoin Core 0.12.0 through 0.21.1 does not properly impleme…6.5
• CVE-2021-31877Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-31878An issue was discovered in PJSIP in Asterisk before 16.19.1 …6.5
• CVE-2021-31879GNU Wget through 1.21.1 does not omit the Authorization head…6.1
• CVE-2021-3188phpList 3.6.0 allows CSV injection, related to the email par…9.8
• CVE-2021-31881A vulnerability has been identified in Capital Embedded AR C…7.5