Denial-of-Service Vulnerability in node-qs
Summary
CVE-2014-10064: The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. Affects node-qs versions < 2.2.4-1. Fixed in 2.2.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-qs package is a module used in web applications to parse query strings. It provides functionality to convert query strings into JavaScript objects. This vulnerability affects versions before 1.0.0 of the qs module in the Debian ecosystem. The package does not have an option or default for specifying object depth, which can lead to a denial-of-service condition when parsing deeply nested objects. An attacker can exploit this vulnerability to block the event loop for extended periods, causing a temporary denial of service.
Vulnerability Detail
The vulnerability, identified as CVE-2014-10064, originates from the qs module's lack of object depth specification. When parsing a string representing a deeply nested object, the event loop can be blocked for a significant amount of time. This can result in a temporary denial-of-service condition, where other requests are not processed during the blocking period. The vulnerability has a CVSSv3 score of 7.5, indicating a high severity.
How To Fix
Minimum fixed version
2.2.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-qsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The Denial-of-Service vulnerability in the node-qs package can be exploited by sending a malicious query string with deeply nested objects, causing a temporary denial-of-service condition. To mitigate this vulnerability, it is crucial to update the package to version 2.2.4-1 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for node-qs →
FAQ
The vulnerability can cause a temporary denial-of-service condition in web applications, where other requests are not processed while the event loop is blocked.
An attacker can send a malicious query string with deeply nested objects to trigger the blocking of the event loop, causing a denial-of-service condition.
Yes, updating the node-qs package to version 2.2.4-1 or later resolves this vulnerability.
No, only versions before 1.0.0 of the qs module in the Debian ecosystem are affected.
The CVSSv3 score of this vulnerability is 7.5, indicating a high severity.
Related vulnerabilities
Recent vulnerabilities recorded for node-qs.
