In short
- CVE-2014-7191 is a MEDIUM (CVSS 5.0) vulnerability affecting node.js (nodejs), qs.
- Chance of exploitation in the next 30 days (EPSS): 8.3%, higher than 94.9% of all vulnerabilities.
- Fix: update to 1.0.0 or later.
| Package | Affected versions | Patched versions |
|---|
| node.js | ≤ 0.10.18
| No fix yet |
| qs npm | < 1.0.0
| 1.0.0
|
Description
Versions prior to 1.0 of qs are affected by a denial of service condition. This condition is triggered by parsing a crafted string that deserializes into very large sparse arrays, resulting in the process running out of memory and eventually crashing.
Recommendation
Update to version 1.0.0 or later.
NVD description
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free