Kurz gesagt
- CVE-2014-7191 ist eine Schwachstelle (MITTEL (CVSS 5.0)) in node.js (nodejs), qs.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 8.3%, höher als bei 94.9% aller Schwachstellen.
- Abhilfe: auf 1.0.0 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| node.js | ≤ 0.10.18
| No fix yet |
| qs npm | < 1.0.0
| 1.0.0
|
Description
Versions prior to 1.0 of qs are affected by a denial of service condition. This condition is triggered by parsing a crafted string that deserializes into very large sparse arrays, resulting in the process running out of memory and eventually crashing.
Recommendation
Update to version 1.0.0 or later.
NVD description
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free