Every CVE Search/ Get API key

CVE-2017-1000048

Prototype Pollution Protection Bypass in qs

7.5 HighFix available

the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

2.42%Down 0.5 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.

Record
CVE-2017-1000048
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.

Record
CVE-2017-1000048
Updated
2026-11-02
EUVDEUVD-2020-0380 No score

the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.

Record
EUVD-2020-0380
Updated
2026-11-03
GitHub AdvisoriesGHSA-gqgv-6jq5-jjj9 7.5

Prototype Pollution Protection Bypass in qs

Affected version of qs are vulnerable to Prototype Pollution because it is possible to bypass the protection. The qs.parse function fails to properly prevent an object's prototype to be altered when parsing arbitrary input. Input containing [ or ] may bypass the prototype pollution protection and alter the Object prototype. This allows attackers to override properties that will exist in all objects, which may lead to Denial of Service or Remote Code Execution in specific circumstances.

Recommendation

Upgrade to 6.0.4, 6.1.2, 6.2.3, 6.3.2 or later.

Record
GHSA-gqgv-6jq5-jjj9
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02
OSVAZL-45075 7.5

CVE-2017-1000048 affecting package nodejs-nodemon 2.0.3-5

the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.

Record
AZL-45075
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-05
OSV 7.5

the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.

Record
CVE-2017-1000048
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 16 moreShow less
OSVGHSA-gqgv-6jq5-jjj9 7.5

Prototype Pollution Protection Bypass in qs

Affected version of qs are vulnerable to Prototype Pollution because it is possible to bypass the protection. The qs.parse function fails to properly prevent an object's prototype to be altered when parsing arbitrary input. Input containing [ or ] may bypass the prototype pollution protection and alter the Object prototype. This allows attackers to override properties that will exist in all objects, which may lead to Denial of Service or Remote Code Execution in specific circumstances.

Recommendation

Upgrade to 6.0.4, 6.1.2, 6.2.3, 6.3.2 or later.

Record
GHSA-gqgv-6jq5-jjj9
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02
OSVRHSA-2017:2672 5.3

Red Hat Security Advisory: rh-nodejs6-nodejs-qs security update

Record
RHSA-2017:2672
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVCLSA-2026-1771459792 No score

TuxCare security update for qs (2 CVEs)

TuxCare rebuilt qs to address 2 CVEs. Fixed in 1.2.2-tuxcare.1.

Record
CLSA-2026-1771459792
Updated
2026-11-02
OSVCLSA-2026-1773101688 No score

TuxCare security update for qs (3 CVEs)

TuxCare rebuilt qs to address 3 CVEs. Fixed in 5.2.0-tuxcare.1.

Record
CLSA-2026-1773101688
Updated
2026-11-02
OSVCLSA-2026-1773101691 No score

TuxCare security update for qs (3 CVEs)

TuxCare rebuilt qs to address 3 CVEs. Fixed in 5.1.0-tuxcare.1.

Record
CLSA-2026-1773101691
Updated
2026-11-02
OSVCLSA-2026-1773188136 No score

TuxCare security update for qs (1 CVE)

TuxCare rebuilt qs to address 1 CVE. Fixed in 2.4.2-tuxcare.2.

Record
CLSA-2026-1773188136
Updated
2026-11-02
OSVCLSA-2026-1773274549 No score

TuxCare security update for qs (2 CVEs)

TuxCare rebuilt qs to address 2 CVEs. Fixed in 2.2.5-tuxcare.1.

Record
CLSA-2026-1773274549
Updated
2026-11-02
OSVCLSA-2026-1773274550 No score

TuxCare security update for qs (3 CVEs)

TuxCare rebuilt qs to address 3 CVEs. Fixed in 2.3.3-tuxcare.1.

Record
CLSA-2026-1773274550
Updated
2026-11-02
OSVCLSA-2026-1775694706 No score

TuxCare security update for qs (4 CVEs)

TuxCare rebuilt qs to address 4 CVEs. Fixed in 0.5.1-tuxcare.1.

Record
CLSA-2026-1775694706
Updated
2026-11-02
OSVCLSA-2026-1784509773 No score

TuxCare security update for qs (2 CVEs)

TuxCare rebuilt qs to address 2 CVEs. Fixed in 5.2.1-tuxcare.1.

Record
CLSA-2026-1784509773
Updated
2026-11-02
OSVCLSA-2026-1784509812 No score

TuxCare security update for qs (1 CVE)

TuxCare rebuilt qs to address 1 CVE. Fixed in 3.1.0-tuxcare.1.

Record
CLSA-2026-1784509812
Updated
2026-11-02
OSVCLSA-2026-1784596277 No score

TuxCare security update for qs (1 CVE)

TuxCare rebuilt qs to address 1 CVE. Fixed in 2.2.4-tuxcare.1.

Record
CLSA-2026-1784596277
Updated
2026-11-02
OSVCLSA-2026-1791373797 No score

TuxCare security update for qs (5 CVEs)

TuxCare rebuilt qs to address 5 CVEs. Fixed in 0.6.5-tuxcare.1.

Record
CLSA-2026-1791373797
Updated
2026-11-02
OSVCLSA-2026-1792476180 No score

TuxCare security update for qs (4 CVEs)

TuxCare rebuilt qs to address 4 CVEs. Fixed in 6.2.1-tuxcare.1.

Record
CLSA-2026-1792476180
Updated
2026-11-02
OSVCLSA-2026-1793015893 No score

TuxCare security update for qs (5 CVEs)

TuxCare rebuilt qs to address 5 CVEs. Fixed in 0.4.2-tuxcare.1.

Record
CLSA-2026-1793015893
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2017-1000048 No score

CVE-2017-1000048 in @rootio/qs - Patched by Root

Root has patched CVE-2017-1000048 in the @rootio/qs package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2017-1000048
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
qs
npm
 before 6.0.4
6.0.4
qs
npm
 6.1.0 up to 6.1.2
6.1.2
qs
npm
 6.2.0 up to 6.2.3
6.2.3
qs
npm
 6.3.0 up to 6.3.2
6.3.2
nodejs-nodemon
Azure Linux:3
 through 2.0.3-5 None known
qs
TuxCare:npm
From an advisory covering 2 CVEs
 1.2.2-tuxcare.0 up to 1.2.2-tuxcare.1, plus listed versions
1.2.2
1.2.2-tuxcare.1
qs
TuxCare:npm
From an advisory covering 3 CVEs
 5.2.0-tuxcare.0 up to 5.2.0-tuxcare.1, plus listed versions
5.2.0
5.2.0-tuxcare.1
qs
TuxCare:npm
From an advisory covering 3 CVEs
 5.1.0-tuxcare.0 up to 5.1.0-tuxcare.1, plus listed versions
5.1.0
5.1.0-tuxcare.1
qs
TuxCare:npm
 2.4.2-tuxcare.0 up to 2.4.2-tuxcare.2, plus listed versions
2.4.22.4.2-tuxcare.1
2.4.2-tuxcare.2
qs
TuxCare:npm
From an advisory covering 2 CVEs
 2.2.5-tuxcare.0 up to 2.2.5-tuxcare.1, plus listed versions
2.2.5
2.2.5-tuxcare.1
Show 12 moreShow less
Affected packages
PackageAffectedFixed
qs
TuxCare:npm
From an advisory covering 3 CVEs
 2.3.3-tuxcare.0 up to 2.3.3-tuxcare.1, plus listed versions
2.3.3
2.3.3-tuxcare.1
qs
TuxCare:npm
From an advisory covering 4 CVEs
 0.5.1-tuxcare.0 up to 0.5.1-tuxcare.1, plus listed versions
0.5.1
0.5.1-tuxcare.1
qs
TuxCare:npm
From an advisory covering 2 CVEs
 5.2.1-tuxcare.0 up to 5.2.1-tuxcare.1, plus listed versions
5.2.1
5.2.1-tuxcare.1
qs
TuxCare:npm
 3.1.0-tuxcare.0 up to 3.1.0-tuxcare.1, plus listed versions
3.1.0
3.1.0-tuxcare.1
qs
TuxCare:npm
 2.2.4-tuxcare.0 up to 2.2.4-tuxcare.1, plus listed versions
2.2.4
2.2.4-tuxcare.1
qs
TuxCare:npm
From an advisory covering 5 CVEs
 0.6.5-tuxcare.0 up to 0.6.5-tuxcare.1, plus listed versions
0.6.5
0.6.5-tuxcare.1
qs
TuxCare:npm
From an advisory covering 4 CVEs
 6.2.1-tuxcare.0 up to 6.2.1-tuxcare.1, plus listed versions
6.2.1
6.2.1-tuxcare.1
qs
TuxCare:npm
From an advisory covering 5 CVEs
 0.4.2-tuxcare.0 up to 0.4.2-tuxcare.1, plus listed versions
0.4.2
0.4.2-tuxcare.1
rh-nodejs6-nodejs-qs
Red Hat:rhel_software_collections:2::el6
 before 0:6.2.3-1.el6
0:6.2.3-1.el6
rh-nodejs6-nodejs-qs
Red Hat:rhel_software_collections:2::el7
 before 0:6.2.3-1.el7
0:6.2.3-1.el7
@rootio/qs
Root:npm
 before 4.0.0-root.io.1
4.0.0-root.io.1
qs
Root:npm
 before 4.0.0-aikido.1
4.0.0-aikido.1

History

History
RecordedChangedSources
affected
factsOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-1000048 is a high vulnerability (CVSS 7.5) in Qs Project Qs, published July 13, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.42%, the 84th percentile. Fixed in qs 6.0.4.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open