Skip to content

CVE-2017-1000048 Prototype Pollution Protection Bypass in qs

HighCVSS 7.5 EPSS 2.4%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.

Affected products

ProductAffected versionsFixed in
npm qs(npm) < 6.0.4 6.0.4
npm qs(npm) >= 6.1.0, < 6.1.2 6.1.2
npm qs(npm) >= 6.2.0, < 6.2.3 6.2.3
npm qs(npm) >= 6.3.0, < 6.3.2 6.3.2
qs project qs = 1.0.0 No fix listed
qs project qs = 1.0.1 No fix listed
qs project qs = 1.0.2 No fix listed
qs project qs = 1.1.0 No fix listed
qs project qs = 1.2.0 No fix listed
qs project qs = 1.2.1 No fix listed
qs project qs = 2.3.1 No fix listed
qs project qs = 2.3.2 No fix listed
qs project qs = 2.3.3 No fix listed
qs project qs = 2.4.0 No fix listed
qs project qs = 2.4.1 No fix listed
qs project qs = 2.4.2 No fix listed
qs project qs = 3.0.0 No fix listed
qs project qs = 3.1.0 No fix listed
qs project qs = 4.0.0 No fix listed
qs project qs = 5.0.0 No fix listed
qs project qs = 5.1.0 No fix listed
qs project qs = 5.2.0 No fix listed
qs project qs = 5.2.1 No fix listed
qs project qs = 6.0.0 No fix listed
qs project qs = 6.0.1 No fix listed
Show 9 more
ProductAffected versionsFixed in
qs project qs = 6.0.2 No fix listed
qs project qs = 6.0.3 No fix listed
qs project qs = 6.1.0 No fix listed
qs project qs = 6.1.1 No fix listed
qs project qs = 6.2.0 No fix listed
qs project qs = 6.2.1 No fix listed
qs project qs = 6.2.2 No fix listed
qs project qs = 6.3.0 No fix listed
qs project qs = 6.3.1 No fix listed

References