CVE-2014-10064
Denial-of-Service Extended Event Loop Blocking in qs
CVE-2014-10064 is a high vulnerability (CVSS 7.5) in Qs Project Qs, published May 31, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.38%, the 72nd percentile. Fixed in qs 1.0.0.
The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example, in a web application, other requests would not be processed while this blocking is occurring.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example, in a web application, other requests would not be processed while this blocking is occurring.
- Record
CVE-2014-10064- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-400, CWE-399
- Updated
- 2026-11-02
CVE List No score
The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example, in a web application, other requests would not be processed while this blocking is occurring.
- Record
CVE-2014-10064- Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2018-0589 No score
The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example, in a web application, other requests would not be processed while this blocking is occurring.
- Record
EUVD-2018-0589- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f9cm-p3w6-xvr3 No score
Denial-of-Service Extended Event Loop Blocking in qs
Versions prior to 1.0.0 of qs are affected by a denial of service vulnerability that results from excessive recursion in parsing a deeply nested JSON string.
Recommendation
Update to version 1.0.0 or later
- Record
GHSA-f9cm-p3w6-xvr3- Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example, in a web application, other requests would not be processed while this blocking is occurring.
- Record
CVE-2014-10064- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-10064
The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example, in a web application, other requests would not be processed while this blocking is occurring.
- Record
DEBIAN-CVE-2014-10064- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2014-10064
The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example, in a web application, other requests would not be processed while this blocking is occurring.
- Record
UBUNTU-CVE-2014-10064- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1775694706 No score
TuxCare security update for qs (4 CVEs)
TuxCare rebuilt qs to address 4 CVEs. Fixed in 0.5.1-tuxcare.1.
- Record
CLSA-2026-1775694706- Updated
- 2026-11-02
OSVCLSA-2026-1791373797 No score
TuxCare security update for qs (5 CVEs)
TuxCare rebuilt qs to address 5 CVEs. Fixed in 0.6.5-tuxcare.1.
- Record
CLSA-2026-1791373797- Updated
- 2026-11-02
OSVCLSA-2026-1793015893 No score
TuxCare security update for qs (5 CVEs)
TuxCare rebuilt qs to address 5 CVEs. Fixed in 0.4.2-tuxcare.1.
- Record
CLSA-2026-1793015893- Updated
- 2026-11-02
OSVGHSA-f9cm-p3w6-xvr3 No score
Denial-of-Service Extended Event Loop Blocking in qs
Versions prior to 1.0.0 of qs are affected by a denial of service vulnerability that results from excessive recursion in parsing a deeply nested JSON string.
Recommendation
Update to version 1.0.0 or later
- Record
GHSA-f9cm-p3w6-xvr3- Weakness
- CWE-400
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qsnpm |
before 1.0.0 | 1.0.0 |
qsTuxCare:npm |
0.5.1-tuxcare.0 up to 0.5.1-tuxcare.1, plus listed versions 0.5.1 |
0.5.1-tuxcare.1 |
qsTuxCare:npm |
0.6.5-tuxcare.0 up to 0.6.5-tuxcare.1, plus listed versions 0.6.5 |
0.6.5-tuxcare.1 |
qsTuxCare:npm |
0.4.2-tuxcare.0 up to 0.4.2-tuxcare.1, plus listed versions 0.4.2 |
0.4.2-tuxcare.1 |
node-qsDebian:12 |
before 2.2.4-1 | 2.2.4-1 |
node-qsDebian:13 |
before 2.2.4-1 | 2.2.4-1 |
node-qsDebian:14 |
before 2.2.4-1 | 2.2.4-1 |
node-qsUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 0.4.2-10.6.5-10.6.5-1ubuntu0.1~esm1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |