Denial of Service Vulnerability in Node.js qs Module - CVE-2014-7191
Summary
DEBIAN-CVE-2014-7191: The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse arr... Affects node-qs versions < 2.2.4-1. Fixed in 2.2.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'qs' module is a popular library used in Node.js for parsing and stringifying query strings. It is widely utilized in web applications to handle URL query parameters efficiently. The module's functionality includes support for nested objects and arrays, making it versatile for various data structures. However, prior to version 1.0.0, the qs module contained a vulnerability that could lead to significant memory consumption under certain conditions.
Vulnerability Detail
The vulnerability identified as CVE-2014-7191 arises from the qs module's failure to call the compact function for array data. This oversight allows remote attackers to exploit the module by sending a large index value, which creates a sparse array. Consequently, this can lead to denial of service (DoS) due to excessive memory consumption, potentially crashing the application or server utilizing the affected version of the module.
How To Fix
Minimum fixed version
2.2.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-qsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation to restrict the size of index values being processed by the qs module. This can help mitigate the risk of memory consumption until the package is updated. For example, you can check the index values before processing them in your application logic.
Conclusion
CVE-2014-7191 is a significant vulnerability in the qs module of Node.js that can lead to denial of service through memory consumption. It is crucial for developers to update to the patched version 2.2.4-1 or later to mitigate this risk. Implementing input validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for node-qs →
FAQ
CVE-2014-7191 is a vulnerability in the qs module of Node.js that can lead to denial of service due to excessive memory consumption.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions of the qs module prior to 1.0.0 are vulnerable to CVE-2014-7191.
If an immediate update is not possible, implement input validation to restrict the size of index values processed by the qs module as a temporary workaround.
More information can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2014-7191.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-qs.
