Every CVE Search/ Get API key

CVE-2021-44907

A Denial of Service vulnerability exists in qs up to 6.8.0 due to insufficient sanitization of...

7.5 HighRejected

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

What each source reports

GitHub Advisories Score usedGHSA-rq7c-8f3g-q36h 7.5

A Denial of Service vulnerability exists in qs up to 6.8.0 due to insufficient sanitization of...

A Denial of Service vulnerability exists in qs up to 6.8.0 due to insufficient sanitization of property in the gs.parse function. The merge() function allows the assignment of properties on an array in the query. For any property being assigned, a value in the array is converted to an object containing these properties. Essentially, this means that the property whose expected type is Array always has to be checked with Array.isArray() by the user. This may not be obvious to the user and can cause unexpected behavior.

Record
GHSA-rq7c-8f3g-q36h
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
CVE List No score

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none

Record
CVE-2021-44907
Updated
2026-11-02
EUVDEUVD-2021-31706 No score

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none

Record
EUVD-2021-31706
Updated
2026-11-03
NVD No score

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none

Record
CVE-2021-44907
Updated
2026-11-02
OSVUBUNTU-CVE-2021-44907 7.5

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Record
UBUNTU-CVE-2021-44907
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVSUSE-SU-2022:1459-1 No score

Security update for nodejs14

This update for nodejs14 fixes the following issues:

  • CVE-2022-0778: Fixed a infinite loop in BN_mod_sqrt() reachable when parsing certificates (bsc#1196877).
  • CVE-2021-44906: Fixed a prototype pollution in node-minimist (bsc#1198247).
  • CVE-2021-44907: Fixed a potential Denial of Service vulnerability in node-qs (bsc#1197283).
  • CVE-2022-0235: Fixed an exposure of sensitive information to an unauthorized actor in node-fetch (bsc#1194819).
Record
SUSE-SU-2022:1459-1
Updated
2026-11-02
Show 5 moreShow less
OSVSUSE-SU-2022:1461-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

  • CVE-2022-0778: Fixed a infinite loop in BN_mod_sqrt() reachable when parsing certificates (bsc#1196877).
  • CVE-2021-44906: Fixed a prototype pollution in node-minimist (bsc#1198247).
  • CVE-2021-44907: Fixed a potential Denial of Service vulnerability in node-qs (bsc#1197283).
  • CVE-2022-0235: Fixed an exposure of sensitive information to an unauthorized actor in node-fetch (bsc#1194819).
Record
SUSE-SU-2022:1461-1
Updated
2026-11-02
OSVSUSE-SU-2022:1462-1 No score

Security update for nodejs14

This update for nodejs14 fixes the following issues:

  • CVE-2022-0778: Fixed a infinite loop in BN_mod_sqrt() reachable when parsing certificates (bsc#1196877).
  • CVE-2021-44906: Fixed a prototype pollution in node-minimist (bsc#1198247).
  • CVE-2021-44907: Fixed a potential Denial of Service vulnerability in node-qs (bsc#1197283).
  • CVE-2022-0235: Fixed an exposure of sensitive information to an unauthorized actor in node-fetch (bsc#1194819).
Record
SUSE-SU-2022:1462-1
Updated
2026-11-02
OSVSUSE-SU-2022:1466-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

  • CVE-2021-44906: Fixed a prototype pollution in node-minimist (bsc#1198247).
  • CVE-2021-44907: Fixed a potential Denial of Service vulnerability in node-qs (bsc#1197283).
  • CVE-2022-0235: Fixed an exposure of sensitive information to an unauthorized actor in node-fetch (bsc#1194819).
Record
SUSE-SU-2022:1466-1
Updated
2026-11-02
OSVSUSE-SU-2022:1694-1 No score

Security update for nodejs8

This update for nodejs8 fixes the following issues:

  • CVE-2021-44906: Fixed prototype pollution in npm dependency (bsc#1198247).
  • CVE-2021-44907: Fixed insuficient sanitation in npm dependency (bsc#1197283).
  • CVE-2022-0235: Fixed passing of cookie data and sensitive headers to different hostnames in node-fetch-npm (bsc#1194819).
Record
SUSE-SU-2022:1694-1
Updated
2026-11-02
OSVSUSE-SU-2022:1717-1 No score

Security update for nodejs10

This update for nodejs10 fixes the following issues:

  • CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).
  • CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).
  • CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).
  • CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).
  • CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).
  • CVE-2022-21824: Fixed prototype pollution via console.table (bsc#1194514).
  • CVE-2021-44906: Fixed prototype pollution in npm dependency (bsc#1198247).
  • CVE-2021-44907: Fixed insuficient sanitation in npm dependency (bsc#1197283).
  • CVE-2022-0235: Fixed passing of cookie data and sensitive headers to different hostnames in node-fetch-npm (bsc#1194819).
Record
SUSE-SU-2022:1717-1
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
nodejs14
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 4 CVEs
 before 14.19.1-6.28.1
14.19.1-6.28.1
nodejs12
SUSE:Linux Enterprise Module for Web and Scripting 15 SP3
From an advisory covering 4 CVEs
 before 12.22.12-150200.4.32.1
12.22.12-150200.4.32.1
nodejs12
SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS
From an advisory covering 4 CVEs
 before 12.22.12-150200.4.32.1
12.22.12-150200.4.32.1
nodejs12
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
From an advisory covering 4 CVEs
 before 12.22.12-150200.4.32.1
12.22.12-150200.4.32.1
nodejs12
SUSE:Linux Enterprise Server 15 SP2-BCL
From an advisory covering 4 CVEs
 before 12.22.12-150200.4.32.1
12.22.12-150200.4.32.1
nodejs12
SUSE:Linux Enterprise Server 15 SP2-LTSS
From an advisory covering 4 CVEs
 before 12.22.12-150200.4.32.1
12.22.12-150200.4.32.1
nodejs12
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
From an advisory covering 4 CVEs
 before 12.22.12-150200.4.32.1
12.22.12-150200.4.32.1
nodejs12
SUSE:Manager Proxy 4.1
From an advisory covering 4 CVEs
 before 12.22.12-150200.4.32.1
12.22.12-150200.4.32.1
nodejs12
SUSE:Manager Retail Branch Server 4.1
From an advisory covering 4 CVEs
 before 12.22.12-150200.4.32.1
12.22.12-150200.4.32.1
nodejs12
SUSE:Manager Server 4.1
From an advisory covering 4 CVEs
 before 12.22.12-150200.4.32.1
12.22.12-150200.4.32.1
Show 39 moreShow less
Affected packages
PackageAffectedFixed
nodejs12
SUSE:Enterprise Storage 7
From an advisory covering 4 CVEs
 before 12.22.12-150200.4.32.1
12.22.12-150200.4.32.1
nodejs12
openSUSE:Leap 15.3
From an advisory covering 4 CVEs
 before 12.22.12-150200.4.32.1
12.22.12-150200.4.32.1
nodejs12
openSUSE:Leap 15.4
From an advisory covering 4 CVEs
 before 12.22.12-150200.4.32.1
12.22.12-150200.4.32.1
nodejs14
SUSE:Linux Enterprise Module for Web and Scripting 15 SP3
From an advisory covering 4 CVEs
 before 14.19.1-150200.15.31.1
14.19.1-150200.15.31.1
nodejs14
SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS
From an advisory covering 4 CVEs
 before 14.19.1-150200.15.31.1
14.19.1-150200.15.31.1
nodejs14
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
From an advisory covering 4 CVEs
 before 14.19.1-150200.15.31.1
14.19.1-150200.15.31.1
nodejs14
SUSE:Linux Enterprise Server 15 SP2-BCL
From an advisory covering 4 CVEs
 before 14.19.1-150200.15.31.1
14.19.1-150200.15.31.1
nodejs14
SUSE:Linux Enterprise Server 15 SP2-LTSS
From an advisory covering 4 CVEs
 before 14.19.1-150200.15.31.1
14.19.1-150200.15.31.1
nodejs14
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
From an advisory covering 4 CVEs
 before 14.19.1-150200.15.31.1
14.19.1-150200.15.31.1
nodejs14
SUSE:Manager Proxy 4.1
From an advisory covering 4 CVEs
 before 14.19.1-150200.15.31.1
14.19.1-150200.15.31.1
nodejs14
SUSE:Manager Retail Branch Server 4.1
From an advisory covering 4 CVEs
 before 14.19.1-150200.15.31.1
14.19.1-150200.15.31.1
nodejs14
SUSE:Manager Server 4.1
From an advisory covering 4 CVEs
 before 14.19.1-150200.15.31.1
14.19.1-150200.15.31.1
nodejs14
SUSE:Enterprise Storage 7
From an advisory covering 4 CVEs
 before 14.19.1-150200.15.31.1
14.19.1-150200.15.31.1
nodejs14
openSUSE:Leap 15.3
From an advisory covering 4 CVEs
 before 14.19.1-150200.15.31.1
14.19.1-150200.15.31.1
nodejs14
openSUSE:Leap 15.4
From an advisory covering 4 CVEs
 before 14.19.1-150200.15.31.1
14.19.1-150200.15.31.1
nodejs12
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 3 CVEs
 before 12.22.12-1.48.1
12.22.12-1.48.1
nodejs8
openSUSE:Leap 15.3
From an advisory covering 3 CVEs
 before 8.17.0-150200.10.22.1
8.17.0-150200.10.22.1
nodejs8
openSUSE:Leap 15.4
From an advisory covering 3 CVEs
 before 8.17.0-150200.10.22.1
8.17.0-150200.10.22.1
nodejs10
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Linux Enterprise High Performance Computing 15-LTSS
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Linux Enterprise Server 15-LTSS
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Linux Enterprise Server 15 SP1-BCL
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Linux Enterprise Server 15 SP1-LTSS
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Linux Enterprise Server 15 SP2-BCL
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Linux Enterprise Server 15 SP2-LTSS
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Linux Enterprise Server for SAP Applications 15
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Manager Proxy 4.1
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Manager Retail Branch Server 4.1
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Manager Server 4.1
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Enterprise Storage 6
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
SUSE:Enterprise Storage 7
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
openSUSE:Leap 15.3
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1
nodejs10
openSUSE:Leap 15.4
From an advisory covering 9 CVEs
 before 10.24.1-150000.1.44.1
10.24.1-150000.1.44.1

History

History
RecordedChangedSources
affected, facts
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-44907 has been rejected by its source and should not be treated as a live vulnerability, published March 17, 2022.

References

Show 28 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open