In breve
- CVE-2014-7191 è una vulnerabilità MEDIO (CVSS 5.0) che riguarda node.js (nodejs), qs.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 8.3%, superiore al 94.9% delle vulnerabilità.
- Correzione: aggiornare a 1.0.0 o successiva.
| Package | Affected versions | Patched versions |
|---|
| node.js | ≤ 0.10.18
| No fix yet |
| qs npm | < 1.0.0
| 1.0.0
|
Description
Versions prior to 1.0 of qs are affected by a denial of service condition. This condition is triggered by parsing a crafted string that deserializes into very large sparse arrays, resulting in the process running out of memory and eventually crashing.
Recommendation
Update to version 1.0.0 or later.
NVD description
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free