Packages / qs / Security

HighVulnerabilityGHSA-f9cm-p3w6-xvr3CVE-2014-10064Published 9 Oct 2018

Denial-of-Service Extended Event Loop Blocking in qs

Your version

Affected releases · qs

  • 0.6.x and older0.0.1 – 0.6.6No fix, no longer updated

0.6.x has no fix yet; the newest fixed line:

npm install qs@1.0.0
Every release on a timeline
6.x

  1. Not affected

    6.0.0 – 6.17.1

    100 releases, latest

0.x

  1. Affected

    0.0.1 – 0.6.6

    29 releases

158 stable releases of qs, oldest to newest, one row per major.

What happens

Versions prior to 1.0.0 of qs are affected by a denial of service vulnerability that results from excessive recursion in parsing a deeply nested JSON string.

Recommendation

Update to version 1.0.0 or later