CVE-2014-7191
Denial-of-Service Memory Exhaustion in qs
CVE-2014-7191 is a medium vulnerability (CVSS 5.0) in Nodejs Node.js, published October 19, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.31%, the 94th percentile. Fixed in qs 1.0.0.
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.
Exploit likelihood
What each source reports
NVD Score used
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.
- Record
CVE-2014-7191- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.
- Record
CVE-2014-7191- Updated
- 2026-11-02
EUVDEUVD-2017-0262 No score
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.
- Record
EUVD-2017-0262- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jjv7-qpx3-h62q No score
Denial-of-Service Memory Exhaustion in qs
Versions prior to 1.0 of qs are affected by a denial of service condition. This condition is triggered by parsing a crafted string that deserializes into very large sparse arrays, resulting in the process running out of memory and eventually crashing.
Recommendation
Update to version 1.0.0 or later.
- Record
GHSA-jjv7-qpx3-h62q- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVCLSA-2026-1775694706 No score
TuxCare security update for qs (4 CVEs)
TuxCare rebuilt qs to address 4 CVEs. Fixed in 0.5.1-tuxcare.1.
- Record
CLSA-2026-1775694706- Updated
- 2026-11-02
OSVCLSA-2026-1791373797 No score
TuxCare security update for qs (5 CVEs)
TuxCare rebuilt qs to address 5 CVEs. Fixed in 0.6.5-tuxcare.1.
- Record
CLSA-2026-1791373797- Updated
- 2026-11-02
Show 5 moreShow less
OSVCLSA-2026-1793015893 No score
TuxCare security update for qs (5 CVEs)
TuxCare rebuilt qs to address 5 CVEs. Fixed in 0.4.2-tuxcare.1.
- Record
CLSA-2026-1793015893- Updated
- 2026-11-02
OSV No score
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.
- Record
CVE-2014-7191- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-7191 No score
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.
- Record
DEBIAN-CVE-2014-7191- Updated
- 2026-11-02
OSVGHSA-jjv7-qpx3-h62q No score
Denial-of-Service Memory Exhaustion in qs
Versions prior to 1.0 of qs are affected by a denial of service condition. This condition is triggered by parsing a crafted string that deserializes into very large sparse arrays, resulting in the process running out of memory and eventually crashing.
Recommendation
Update to version 1.0.0 or later.
- Record
GHSA-jjv7-qpx3-h62q- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-7191 No score
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.
- Record
UBUNTU-CVE-2014-7191- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qsnpm |
before 1.0.0 | 1.0.0 |
qsTuxCare:npm |
0.5.1-tuxcare.0 up to 0.5.1-tuxcare.1, plus listed versions 0.5.1 |
0.5.1-tuxcare.1 |
qsTuxCare:npm |
0.6.5-tuxcare.0 up to 0.6.5-tuxcare.1, plus listed versions 0.6.5 |
0.6.5-tuxcare.1 |
qsTuxCare:npm |
0.4.2-tuxcare.0 up to 0.4.2-tuxcare.1, plus listed versions 0.4.2 |
0.4.2-tuxcare.1 |
node-qsDebian:12 |
before 2.2.4-1 | 2.2.4-1 |
node-qsDebian:13 |
before 2.2.4-1 | 2.2.4-1 |
node-qsDebian:14 |
before 2.2.4-1 | 2.2.4-1 |
nodejs010-node-gypRed Hat:rhel_software_collections:2::el6 |
before 0:3.2.0-3.el6 | 0:3.2.0-3.el6 |
nodejs010-nodejs-qsRed Hat:rhel_software_collections:2::el6 |
before 0:0.6.5-5.el6 | 0:0.6.5-5.el6 |
nodejs010-node-gypRed Hat:rhel_software_collections:2::el7 |
before 0:3.2.0-3.el7 | 0:3.2.0-3.el7 |
nodejs010-nodejs-qsRed Hat:rhel_software_collections:2::el7 |
before 0:0.6.5-5.el7 | 0:0.6.5-5.el7 |
node-qsUbuntu:Pro:14.04:LTS |
before 0.6.5-1ubuntu0.1~esm1, plus listed versions 0.4.2-10.6.5-1 |
0.6.5-1ubuntu0.1~esm1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
secunia.com/advisories/60026
github.com/visionmedia/node-querystring/issues/104
access.redhat.com/errata/RHSA-2016:1380
nodesecurity.io/advisories/qs_dos_memory_exhaustion
Show 16 moreShow less
www-01.ibm.com/support/docview.wss?uid=swg21687928
exchange.xforce.ibmcloud.com/vulnerabilities/96729
nvd.nist.gov/vuln/detail/CVE-2014-7191
npmjs.com/advisories/29
security-tracker.debian.org/tracker/CVE-2014-7191
bugzilla.redhat.com/show_bug.cgi?id=1146054
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1380.json
cve.org/CVERecord?id=CVE-2014-7191
ubuntu.com/security/CVE-2014-7191