Em resumo
- CVE-2014-7191 é uma vulnerabilidade MÉDIO (CVSS 5.0) que afeta node.js (nodejs), qs.
- Chance de exploração nos próximos 30 dias (EPSS): 8.3%, maior que 94.9% das vulnerabilidades.
- Correção: atualize para 1.0.0 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| node.js | ≤ 0.10.18
| No fix yet |
| qs npm | < 1.0.0
| 1.0.0
|
Description
Versions prior to 1.0 of qs are affected by a denial of service condition. This condition is triggered by parsing a crafted string that deserializes into very large sparse arrays, resulting in the process running out of memory and eventually crashing.
Recommendation
Update to version 1.0.0 or later.
NVD description
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free