CVE-2014-7191: Denial-of-Service Memory Exhaustion in qs
Summary
CVE-2014-7191: Denial-of-Service Memory Exhaustion in qs. Affects qs versions < 1.0.0. Fixed in 1.0.0. How to fix ↓
Also tracked for
- node-qs · Debian:11
The same CVE-2014-7191 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'qs' package is an npm package used for parsing and stringifying URL query strings. It provides a simple and convenient way to handle query string parameters in web applications. However, versions prior to 1.0 of 'qs' are vulnerable to a denial-of-service (DoS) attack that can lead to memory exhaustion and process crashes.
Vulnerability Detail
The vulnerability in 'qs' arises from a flaw in the parsing of crafted strings that can deserialize into very large sparse arrays. When such a string is processed, it causes the application to consume excessive amounts of memory, eventually leading to a crash. An attacker can exploit this vulnerability by sending specially crafted query strings to the application, causing a DoS condition. The impact of this vulnerability can range from service disruption to complete system unavailability.
How To Fix
Latest published version: 6.16.1 as of 22 Oct 2026
npm install qs@6.16.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.0
This is the first release that contains the fix.
npm install qs@1.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the 'qs' package to the fixed version to mitigate the risk of a DoS attack.
Conclusion
The 'qs' package prior to version 1.0 is vulnerable to a denial-of-service attack that can lead to memory exhaustion and process crashes. To mitigate this risk, it is crucial to update the package to version 1.0.0 or later. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for qs →
FAQ
The 'qs' package is an npm package used for parsing and stringifying URL query strings in web applications.
The vulnerability can lead to a denial-of-service condition, causing memory exhaustion and process crashes in the affected application.
An attacker can exploit this vulnerability by sending specially crafted query strings to the application, triggering the memory exhaustion and causing a DoS condition.
No, there is no known workaround for this vulnerability. Updating the 'qs' package to the fixed version is the recommended solution.
To fix this vulnerability, update the 'qs' package to version 1.0.0 or later, which includes a patch to address the memory exhaustion issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for qs.
