CVE-2022-24999: Prototype Pollution in qs
Summary
Your scan reports qs 6.5.2. Fixed in 6.5.3.
CVE-2022-24999: qs vulnerable to Prototype Pollution. Affects qs across 9 version ranges.
< 6.2.4
>= 6.3.0, < 6.3.3
>= 6.4.0, < 6.4.1
>= 6.5.0, < 6.5.3
>= 6.6.0, < 6.6.1
>= 6.7.0, < 6.7.3
>= 6.8.0, < 6.8.3
>= 6.9.0, < 6.9.7
>= 6.10.0, < 6.10.3
Fixed in 6.5.3. How to fix ↓
Also tracked for
- node-qs · Debian:11
The same CVE-2022-24999 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Background
qs is an npm package used for parsing and stringifying URL query strings. It is commonly used in web frameworks to handle query parameters. The package is vulnerable to Prototype Pollution, which allows attackers to modify the prototype of objects and potentially execute arbitrary code.
Vulnerability Detail
The vulnerability in qs arises from the ability to include an __proto__ key in the query string of a URL. By crafting a malicious query string, an unauthenticated remote attacker can manipulate the prototype of objects in the application's code, leading to various security issues. This can result in a Node process hang or potentially allow the execution of arbitrary code.
How To Fix
Latest published version: 6.16.1 as of 22 Oct 2026
npm install qs@6.16.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.5.3
This is the first release that contains the fix.
npm install qs@6.5.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is to sanitize and validate the query string inputs to prevent the inclusion of the __proto__ key. This can be done by explicitly removing or rejecting any query parameters that contain this key.
Conclusion
The vulnerability in qs package allows attackers to exploit Prototype Pollution, potentially leading to a Node process hang or the execution of arbitrary code. It is crucial to update the package to the fixed versions or apply the provided workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for qs →
FAQ
Prototype Pollution is a vulnerability that allows attackers to modify the prototype of objects in JavaScript, leading to unexpected behavior and potential security issues.
An attacker can exploit this vulnerability by crafting a malicious query string with an __proto__ key, which can modify the prototype of objects in the application's code.
The potential consequences of this vulnerability include a Node process hang or the execution of arbitrary code, depending on how the attacker manipulates the prototype of objects.
Yes, the vulnerability can be fixed by updating the qs package to version 6.10.3 or later. Backported fixes are also available for earlier versions.
A temporary workaround is to sanitize and validate the query string inputs to prevent the inclusion of the __proto__ key.
References
Related vulnerabilities
Recent vulnerabilities recorded for qs.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.