CVE-2017-1000048: Prototype Pollution Protection Bypass in qs
Summary
CVE-2017-1000048: Prototype Pollution Protection Bypass in qs. Affects qs across 4 version ranges.
< 6.0.4
>= 6.1.0, < 6.1.2
>= 6.2.0, < 6.2.3
>= 6.3.0, < 6.3.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- qs · ghsa
The same CVE-2017-1000048 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'qs' is an npm package used for parsing query strings. It provides a way to convert query strings into JavaScript objects and vice versa. The package is widely used in web applications to handle URL parameters and query strings. However, versions of 'qs' prior to 6.0.4, 6.1.2, 6.2.3, and 6.3.2 are vulnerable to a Prototype Pollution attack.
Vulnerability Detail
The vulnerability in 'qs' is related to Prototype Pollution. The 'qs.parse' function fails to properly prevent an object's prototype from being altered when parsing arbitrary input. This allows an attacker to bypass the prototype pollution protection and alter the Object prototype. By injecting specially crafted input containing '[' or ']', an attacker can override properties that exist in all objects. This can lead to Denial of Service or Remote Code Execution in certain scenarios.
How To Fix
Latest published version: 6.16.1 as of 22 Oct 2026
npm install qs@6.16.1Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 6.0.46.0.4npm install qs@6.0.4 -
>= 6.1.0, < 6.1.26.1.2npm install qs@6.1.2 -
>= 6.2.0, < 6.2.36.2.3npm install qs@6.2.3 -
>= 6.3.0, < 6.3.26.3.2npm install qs@6.3.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed versions of 'qs' to mitigate the risk of exploitation.
Conclusion
The 'qs' package is vulnerable to Prototype Pollution, which can lead to Denial of Service or Remote Code Execution. It is crucial to upgrade to the fixed versions of 'qs' (6.0.4, 6.1.2, 6.2.3, 6.3.2, or later) to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for qs →
FAQ
Prototype Pollution is a vulnerability that occurs when a user-controlled input is not properly sanitized and can modify the prototype of an object. This can lead to unexpected behavior and security issues.
An attacker can exploit this vulnerability by injecting specially crafted input containing '[' or ']' characters. This allows them to override properties in all objects, potentially leading to Denial of Service or Remote Code Execution.
No, only versions prior to 6.0.4, 6.1.2, 6.2.3, and 6.3.2 are vulnerable. It is recommended to upgrade to the fixed versions to mitigate the risk.
The consequences of this vulnerability can vary depending on the specific application and how 'qs' is used. In some cases, it can lead to Denial of Service or Remote Code Execution, allowing an attacker to take control of the affected system.
There is no specific information about known exploits in the wild targeting this vulnerability. However, it is always recommended to promptly update vulnerable packages to prevent potential attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for qs.
