CVE-2014-7191 Denial-of-Service Memory Exhaustion in qs
MediumCVSS 5.0
EPSS 8.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm qs(npm) | < 1.0.0 | 1.0.0 |
| debian/node-qs(Debian:12) | < 2.2.4-1 | 2.2.4-1 |
| debian/node-qs(Debian:13) | < 2.2.4-1 | 2.2.4-1 |
| debian/node-qs(Debian:14) | < 2.2.4-1 | 2.2.4-1 |
| nodejs node.js | <= 0.10.18 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com
- github.com
- www.npmjs.com
- github.com patch
- RHSA-2016:1380 vendor-advisory
- nodejs-cve20147191-dos(96729) vdb-entry
- 60026 third-party-advisory
- 62170 third-party-advisory
- www-01.ibm.com
- www-01.ibm.com
- www-01.ibm.com
- Debian Security Tracker CVE-2014-7191 vendor-advisory
- nodesecurity.io