CVE-2022-24999highCWE-1321

CVE-2022-24999

Published · Updated

Follow this CVE+ Monitor node-qs+ Monitor qs

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

26Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 16%
In short

A flaw in the qs library allows attackers to hang Node.js applications by sending specially crafted queries that exploit the __proto__ property. An unauthenticated attacker can trigger this remotely through a simple URL query string, causing the server to become unresponsive.

Technical detail

The qs query parser fails to properly sanitize __proto__ keys during object merging, enabling prototype pollution that causes excessive memory allocation and CPU consumption. An unauthenticated remote attacker can craft a GET request with nested __proto__ assignments and large length values to induce denial of service in Express applications.

Summary generated and translated by AI from the official description.
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
n/a · n/a