Packages / qs / Security

HighVulnerabilityGHSA-hrpp-h998-j3ppCVE-2022-24999Published 27 Nov 2022

qs vulnerable to Prototype Pollution

Your version

Affected releases · qs

  • 6.x6.0.0 – 6.10.2Fixed in 6.10.3
  • 5.x and older0.0.1 – 5.2.1No fix, no longer updated

On 6.x, the newest line:

npm install qs@6.10.3
Every release on a timeline
6.x

  1. Affected

    6.0.0 – 6.2.3

    16 releases

  2. Fixed

    6.2.4 – 6.2.6

    3 releases

  3. Affected

    6.3.0 – 6.3.2

    3 releases

  4. Fixed

    6.3.3 – 6.3.5

    3 releases

  5. Affected

    6.4.0

    1 release

  6. Fixed

    6.4.1 – 6.4.3

    3 releases

  7. Affected

    6.5.0 – 6.5.2

    3 releases

  8. Fixed

    6.5.3 – 6.5.5

    3 releases

  9. Affected

    6.6.0

    1 release

  10. Fixed

    6.6.1 – 6.6.3

    3 releases

  11. Affected

    6.7.0 – 6.7.2

    3 releases

  12. Fixed

    6.7.3 – 6.7.5

    3 releases

  13. Affected

    6.8.0 – 6.8.2

    3 releases

  14. Fixed

    6.8.3 – 6.8.5

    3 releases

  15. Affected

    6.9.0 – 6.9.6

    7 releases

  16. Fixed

    6.9.7 – 6.9.9

    3 releases

  17. Affected

    6.10.0 – 6.10.2

    3 releases

  18. Fixed

    6.10.3 – 6.17.1

    36 releases, latest

5.x

  1. Affected

    5.0.0 – 5.2.1

    4 releases

4.x

  1. Affected

    4.0.0

    1 release

3.x

  1. Affected

    3.0.0 – 3.1.0

    2 releases

2.x

  1. Affected

    2.0.0 – 2.4.2

    15 releases

1.x

  1. Affected

    1.0.0 – 1.2.2

    7 releases

0.x

  1. Affected

    0.0.1 – 0.6.6

    29 releases

158 stable releases of qs, oldest to newest, one row per major.

What happens

qs before 6.10.3 allows attackers to cause a Node process hang because an __ proto__ key can be used. In many typical web framework use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4.