CVE-2014-7191
published 2014-10-19CVE-2014-7191: The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory…
PriorityP428medium5CVSS 2.0
AVNACLAuNCNINAP
EPSS
8.31%
94.3th percentile
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | node-qs | < node-qs 2.2.4-1 (bookworm) | node-qs 2.2.4-1 (bookworm) |
| nodejs | node.js | <= 0.10.18 | — |
| qs_project | qs | >= 0 < 1.0.0 | 1.0.0 |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv5.0MEDIUM
vendor_debian5.0MEDIUM
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Denial-of-Service Memory Exhaustion in qs
osv·2017-10-24
CVE-2014-7191 [HIGH] Denial-of-Service Memory Exhaustion in qs
Denial-of-Service Memory Exhaustion in qs
Versions prior to 1.0 of `qs` are affected by a denial of service condition. This condition is triggered by parsing a crafted string that deserializes into very large sparse arrays, resulting in the process running out of memory and eventually crashing.
## Recommendation
Update to version 1.0.0 or later.
GHSA
Denial-of-Service Memory Exhaustion in qs
ghsa·2017-10-24
CVE-2014-7191 [HIGH] CWE-400 Denial-of-Service Memory Exhaustion in qs
Denial-of-Service Memory Exhaustion in qs
Versions prior to 1.0 of `qs` are affected by a denial of service condition. This condition is triggered by parsing a crafted string that deserializes into very large sparse arrays, resulting in the process running out of memory and eventually crashing.
## Recommendation
Update to version 1.0.0 or later.
OSV
CVE-2014-7191: The qs module before 1
osv·2014-10-19·CVSS 5.0
CVE-2014-7191 [MEDIUM] CVE-2014-7191: The qs module before 1
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.
Red Hat
nodejs-qs: Denial-of-Service Memory Exhaustion
vendor_redhat·2014-08-06·CVSS 5.0
CVE-2014-7191 [MEDIUM] CWE-400 nodejs-qs: Denial-of-Service Memory Exhaustion
nodejs-qs: Denial-of-Service Memory Exhaustion
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.
The nodejs-qs module has the ability to create sparse arrays during parsing. By specifying a high index in a querystring parameter it is possible to create a large array that will eventually take up all the allocated memory of the running process, resulting in a crash.
Statement: This package is not shipped with any versions of Red Hat Enterprise Linux. Red Hat Software Collections Library components shipping in version 2.2 are affected.
Debian
CVE-2014-7191: node-qs - The qs module before 1.0.0 in Node.js does not call the compact function for arr...
vendor_debian·2014·CVSS 5.0
CVE-2014-7191 [MEDIUM] CVE-2014-7191: node-qs - The qs module before 1.0.0 in Node.js does not call the compact function for arr...
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.
Scope: local
bookworm: resolved (fixed in 2.2.4-1)
bullseye: resolved (fixed in 2.2.4-1)
forky: resolved (fixed in 2.2.4-1)
sid: resolved (fixed in 2.2.4-1)
trixie: resolved (fixed in 2.2.4-1)
No detection rules found.
No public exploits indexed.
http://secunia.com/advisories/60026http://secunia.com/advisories/62170http://www-01.ibm.com/support/docview.wss?uid=swg21685987http://www-01.ibm.com/support/docview.wss?uid=swg21687263http://www-01.ibm.com/support/docview.wss?uid=swg21687928https://access.redhat.com/errata/RHSA-2016:1380https://exchange.xforce.ibmcloud.com/vulnerabilities/96729https://github.com/raymondfeng/node-querystring/commit/43a604b7847e56bba49d0ce3e222fe89569354d8https://github.com/visionmedia/node-querystring/issues/104https://nodesecurity.io/advisories/qs_dos_memory_exhaustionhttp://secunia.com/advisories/60026http://secunia.com/advisories/62170http://www-01.ibm.com/support/docview.wss?uid=swg21685987http://www-01.ibm.com/support/docview.wss?uid=swg21687263http://www-01.ibm.com/support/docview.wss?uid=swg21687928https://access.redhat.com/errata/RHSA-2016:1380https://exchange.xforce.ibmcloud.com/vulnerabilities/96729https://github.com/raymondfeng/node-querystring/commit/43a604b7847e56bba49d0ce3e222fe89569354d8https://github.com/visionmedia/node-querystring/issues/104https://nodesecurity.io/advisories/qs_dos_memory_exhaustion
2014-10-19
Published