NetSight
IP …
high7.5

CVE-2022-24999

qs vulnerable to Prototype Pollution

Impact

qs before 6.10.3 allows attackers to cause a Node process hang because an `__ proto__` key can be used. In many typical web framework use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as `a[__proto__]=b&a[__proto__]&a[length]=100000000`. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4.

Affected packages

EcosystemPackageAffectedFixed in
npmqs>= 6.10.0, < 6.10.36.10.3

Affected products

VendorProductAffected versions
Qs ProjectQs
before 6.2.4
from 6.3.0 before 6.3.3
from 6.5.0 before 6.5.3
from 6.7.0 before 6.7.3
from 6.8.0 before 6.8.3
from 6.9.0 before 6.9.7
OpenjsfExpress
before 4.17.3
DebianDebian Linux
Version 10.0

Weakness classification

CWE-1321

References