~ / search / GHSA-hrpp-h998-j3pp

GHSA-hrpp-h998-j3pp

qs vulnerable to Prototype Pollution

Source: GitHub Advisory Database (reviewed) High CVE-2022-24999

Packages

EcosystemPackageAffectedFixed in
npm qs >= 6.10.0, < 6.10.3 6.10.3
npm qs >= 6.9.0, < 6.9.7 6.9.7
npm qs >= 6.8.0, < 6.8.3 6.8.3
npm qs >= 6.7.0, < 6.7.3 6.7.3
npm qs >= 6.6.0, < 6.6.1 6.6.1
npm qs >= 6.5.0, < 6.5.3 6.5.3
npm qs >= 6.4.0, < 6.4.1 6.4.1
npm qs >= 6.3.0, < 6.3.3 6.3.3
npm qs < 6.2.4 6.2.4

Details

As written in the advisory (Markdown source, shown as plain text).

qs before 6.10.3 allows attackers to cause a Node process hang because an `__ proto__` key can be used. In many typical web framework use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as `a[__proto__]=b&a[__proto__]&a[length]=100000000`. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4.

References

External links from the advisory. They lead to third-party sites.