CVE-2022-24999: Prototype Pollution in qs
Summary
CVE-2022-24999: qs vulnerable to Prototype Pollution. Affects qs across 9 version ranges.
< 6.2.4
>= 6.3.0, < 6.3.3
>= 6.4.0, < 6.4.1
>= 6.5.0, < 6.5.3
>= 6.6.0, < 6.6.1
>= 6.7.0, < 6.7.3
>= 6.8.0, < 6.8.3
>= 6.9.0, < 6.9.7
>= 6.10.0, < 6.10.3
Fixed in 9 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- node-qs · Debian:11
The same CVE-2022-24999 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
qs is an npm package used for parsing and stringifying URL query strings. It is commonly used in web frameworks to handle query parameters. The package is vulnerable to Prototype Pollution, which allows attackers to modify the prototype of objects and potentially execute arbitrary code.
Vulnerability Detail
The vulnerability in qs arises from the ability to include an __proto__ key in the query string of a URL. By crafting a malicious query string, an unauthenticated remote attacker can manipulate the prototype of objects in the application's code, leading to various security issues. This can result in a Node process hang or potentially allow the execution of arbitrary code.
How To Fix
Latest published version: 6.16.1 as of 22 Oct 2026
npm install qs@6.16.1Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 6.2.46.2.4npm install qs@6.2.4 -
>= 6.3.0, < 6.3.36.3.3npm install qs@6.3.3 -
>= 6.4.0, < 6.4.16.4.1npm install qs@6.4.1 -
>= 6.5.0, < 6.5.36.5.3npm install qs@6.5.3 -
>= 6.6.0, < 6.6.16.6.1npm install qs@6.6.1 -
>= 6.7.0, < 6.7.36.7.3npm install qs@6.7.3
Show all 9 release lines
-
>= 6.8.0, < 6.8.36.8.3npm install qs@6.8.3 -
>= 6.9.0, < 6.9.76.9.7npm install qs@6.9.7 -
>= 6.10.0, < 6.10.36.10.3npm install qs@6.10.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is to sanitize and validate the query string inputs to prevent the inclusion of the __proto__ key. This can be done by explicitly removing or rejecting any query parameters that contain this key.
Conclusion
The vulnerability in qs package allows attackers to exploit Prototype Pollution, potentially leading to a Node process hang or the execution of arbitrary code. It is crucial to update the package to the fixed versions or apply the provided workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for qs →
FAQ
Prototype Pollution is a vulnerability that allows attackers to modify the prototype of objects in JavaScript, leading to unexpected behavior and potential security issues.
An attacker can exploit this vulnerability by crafting a malicious query string with an __proto__ key, which can modify the prototype of objects in the application's code.
The potential consequences of this vulnerability include a Node process hang or the execution of arbitrary code, depending on how the attacker manipulates the prototype of objects.
Yes, the vulnerability can be fixed by updating the qs package to version 6.10.3 or later. Backported fixes are also available for earlier versions.
A temporary workaround is to sanitize and validate the query string inputs to prevent the inclusion of the __proto__ key.
References
Related vulnerabilities
Recent vulnerabilities recorded for qs.
