Packages / qs / Security

HighVulnerabilityGHSA-jjv7-qpx3-h62qCVE-2014-7191Published 24 Oct 2017

Denial-of-Service Memory Exhaustion in qs

Your version

Affected releases · qs

  • 0.6.x and older0.0.1 – 0.6.6No fix, no longer updated

0.6.x has no fix yet; the newest fixed line:

npm install qs@1.0.0
Every release on a timeline
6.x

  1. Not affected

    6.0.0 – 6.17.1

    100 releases, latest

0.x

  1. Affected

    0.0.1 – 0.6.6

    29 releases

158 stable releases of qs, oldest to newest, one row per major.

What happens

Versions prior to 1.0 of qs are affected by a denial of service condition. This condition is triggered by parsing a crafted string that deserializes into very large sparse arrays, resulting in the process running out of memory and eventually crashing.

Recommendation

Update to version 1.0.0 or later.