CVE-2014-10064: Denial-of-Service Extended Event Loop Blocking in qs
Summary
CVE-2014-10064: Denial-of-Service Extended Event Loop Blocking in qs. Affects qs versions < 1.0.0. Fixed in 1.0.0. How to fix ↓
Also tracked for
- node-qs · Debian:11
The same CVE-2014-10064 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'qs' package is an npm package that provides a querystring parser for Node.js. It is commonly used to parse and stringify URL query strings. The package allows developers to easily work with query strings by providing functions to parse and stringify them. However, versions prior to 1.0.0 of 'qs' are vulnerable to a denial-of-service (DoS) attack due to excessive recursion when parsing deeply nested JSON strings.
Vulnerability Detail
The vulnerability in 'qs' arises from a flaw in the parsing mechanism of deeply nested JSON strings. An attacker can exploit this vulnerability by sending a specially crafted JSON string that triggers excessive recursion, causing the event loop to block and resulting in a denial-of-service condition. This can lead to service disruption and unavailability. The vulnerability has a high severity rating and is classified under CWE-400.
How To Fix
Latest published version: 6.16.1 as of 22 Oct 2026
npm install qs@6.16.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.0
This is the first release that contains the fix.
npm install qs@1.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the 'qs' package to the fixed version to mitigate the risk of a denial-of-service attack.
Conclusion
The 'qs' package prior to version 1.0.0 is vulnerable to a denial-of-service attack due to excessive recursion when parsing deeply nested JSON strings. To mitigate this vulnerability, it is crucial to update the package to version 1.0.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for qs →
FAQ
The vulnerability can be exploited by an attacker to cause a denial-of-service condition, resulting in service disruption and unavailability.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will alert you in real-time if any open-source vulnerabilities, including this one, are found.
Yes, updating the 'qs' package to version 1.0.0 or later will fix this vulnerability.
No, there are no known workarounds for this vulnerability. Updating the package is the recommended solution.
This vulnerability has a high severity rating.
Related vulnerabilities
Recent vulnerabilities recorded for qs.
