qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs | Jan 12, 2023 | Nov 26, 2022 |
| Centos_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-develUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-packaging | Jan 12, 2023 | Nov 26, 2022 |
| Debian | — | Upgrade node-qs | Feb 1, 2023 | Nov 26, 2022 |
| Oracle_linux | — | Upgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs | Jan 10, 2023 | Nov 26, 2022 |
| Redhat_linux | — | Upgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-debuginfo | Jan 12, 2023 | Nov 26, 2022 |
| Rocky_linux | — | Upgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-devel | Mar 12, 2024 | Nov 26, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 9.0.5 | Sep 30, 2025 | Nov 26, 2022 |
| Ubuntu | — | Upgrade node-qs (Ubuntu Pro) | Jun 26, 2025 | Nov 26, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub