qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application becaus...
Original description
The description as published by the source.
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-24999 node-qs Fixed in: 6.9.4+ds-1+deb11u1
References
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- package github.com
- patch github.com
- web github.com
- web lists.debian.org