Every CVESearch/Get API key

CVE-2017-1000048

Prototype Pollution Protection Bypass in qs

7.5 HighFix available

CVE-2017-1000048 is a high vulnerability (CVSS 7.5) in Qs Project Qs, published July 13, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.42%, the 84th percentile. Fixed in qs 6.0.4.

What does this mean?
Severity
7.5 HighCVSS 3.0, NVD
Exploit chance
2.42%EPSS, 84th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
6.0.4qs +21 more

Description

the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

2.42%Down 0.5 points since Apr 14, 2021
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
qs
npm
before 6.0.4
6.0.4
qs
npm
6.1.0 up to 6.1.2
6.1.2
qs
npm
6.2.0 up to 6.2.3
6.2.3
qs
npm
6.3.0 up to 6.3.2
6.3.2
nodejs-nodemon
Azure Linux:3
through 2.0.3-5None known
qs
TuxCare:npm
From an advisory covering 2 CVEs
1.2.2-tuxcare.0 up to 1.2.2-tuxcare.1, plus listed versions
1.2.2
1.2.2-tuxcare.1
qs
TuxCare:npm
From an advisory covering 3 CVEs
5.2.0-tuxcare.0 up to 5.2.0-tuxcare.1, plus listed versions
5.2.0
5.2.0-tuxcare.1
qs
TuxCare:npm
From an advisory covering 3 CVEs
5.1.0-tuxcare.0 up to 5.1.0-tuxcare.1, plus listed versions
5.1.0
5.1.0-tuxcare.1
qs
TuxCare:npm
2.4.2-tuxcare.0 up to 2.4.2-tuxcare.2, plus listed versions
2.4.22.4.2-tuxcare.1
2.4.2-tuxcare.2
qs
TuxCare:npm
From an advisory covering 2 CVEs
2.2.5-tuxcare.0 up to 2.2.5-tuxcare.1, plus listed versions
2.2.5
2.2.5-tuxcare.1
Show 12 moreShow less
Affected packages
PackageAffectedFixed
qs
TuxCare:npm
From an advisory covering 3 CVEs
2.3.3-tuxcare.0 up to 2.3.3-tuxcare.1, plus listed versions
2.3.3
2.3.3-tuxcare.1
qs
TuxCare:npm
From an advisory covering 4 CVEs
0.5.1-tuxcare.0 up to 0.5.1-tuxcare.1, plus listed versions
0.5.1
0.5.1-tuxcare.1
qs
TuxCare:npm
From an advisory covering 2 CVEs
5.2.1-tuxcare.0 up to 5.2.1-tuxcare.1, plus listed versions
5.2.1
5.2.1-tuxcare.1
qs
TuxCare:npm
3.1.0-tuxcare.0 up to 3.1.0-tuxcare.1, plus listed versions
3.1.0
3.1.0-tuxcare.1
qs
TuxCare:npm
2.2.4-tuxcare.0 up to 2.2.4-tuxcare.1, plus listed versions
2.2.4
2.2.4-tuxcare.1
qs
TuxCare:npm
From an advisory covering 5 CVEs
0.6.5-tuxcare.0 up to 0.6.5-tuxcare.1, plus listed versions
0.6.5
0.6.5-tuxcare.1
qs
TuxCare:npm
From an advisory covering 4 CVEs
6.2.1-tuxcare.0 up to 6.2.1-tuxcare.1, plus listed versions
6.2.1
6.2.1-tuxcare.1
qs
TuxCare:npm
From an advisory covering 5 CVEs
0.4.2-tuxcare.0 up to 0.4.2-tuxcare.1, plus listed versions
0.4.2
0.4.2-tuxcare.1
rh-nodejs6-nodejs-qs
Red Hat:rhel_software_collections:2::el6
before 0:6.2.3-1.el6
0:6.2.3-1.el6
rh-nodejs6-nodejs-qs
Red Hat:rhel_software_collections:2::el7
before 0:6.2.3-1.el7
0:6.2.3-1.el7
@rootio/qs
Root:npm
before 4.0.0-root.io.1
4.0.0-root.io.1
qs
Root:npm
before 4.0.0-aikido.1
4.0.0-aikido.1

What each source reports

NVD Score used7.5

the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.

Record
CVE-2017-1000048
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-20
Updated
2026-11-02
CVE ListNo score

the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.

Record
CVE-2017-1000048
Updated
2026-11-02
EUVDEUVD-2020-0380No score

the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.

Record
EUVD-2020-0380
Updated
2026-11-03
GitHub AdvisoriesGHSA-gqgv-6jq5-jjj97.5

Prototype Pollution Protection Bypass in qs

Affected version of qs are vulnerable to Prototype Pollution because it is possible to bypass the protection. The qs.parse function fails to properly prevent an object's prototype to be altered when parsing arbitrary input. Input containing [ or ] may bypass the prototype pollution protection and alter the Object prototype. This allows attackers to override properties that will exist in all objects, which may lead to Denial of Service or Remote Code Execution in specific circumstances.

Recommendation

Upgrade to 6.0.4, 6.1.2, 6.2.3, 6.3.2 or later.

Record
GHSA-gqgv-6jq5-jjj9
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02
OSVAZL-450757.5

CVE-2017-1000048 affecting package nodejs-nodemon 2.0.3-5

the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.

Record
AZL-45075
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-05
OSV7.5

the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.

Record
CVE-2017-1000048
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 16 moreShow less
OSVGHSA-gqgv-6jq5-jjj97.5

Prototype Pollution Protection Bypass in qs

Affected version of qs are vulnerable to Prototype Pollution because it is possible to bypass the protection. The qs.parse function fails to properly prevent an object's prototype to be altered when parsing arbitrary input. Input containing [ or ] may bypass the prototype pollution protection and alter the Object prototype. This allows attackers to override properties that will exist in all objects, which may lead to Denial of Service or Remote Code Execution in specific circumstances.

Recommendation

Upgrade to 6.0.4, 6.1.2, 6.2.3, 6.3.2 or later.

Record
GHSA-gqgv-6jq5-jjj9
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02
OSVRHSA-2017:26725.3

Red Hat Security Advisory: rh-nodejs6-nodejs-qs security update

Record
RHSA-2017:2672
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVCLSA-2026-1771459792No score

TuxCare security update for qs (2 CVEs)

TuxCare rebuilt qs to address 2 CVEs. Fixed in 1.2.2-tuxcare.1.

Record
CLSA-2026-1771459792
Updated
2026-11-02
OSVCLSA-2026-1773101688No score

TuxCare security update for qs (3 CVEs)

TuxCare rebuilt qs to address 3 CVEs. Fixed in 5.2.0-tuxcare.1.

Record
CLSA-2026-1773101688
Updated
2026-11-02
OSVCLSA-2026-1773101691No score

TuxCare security update for qs (3 CVEs)

TuxCare rebuilt qs to address 3 CVEs. Fixed in 5.1.0-tuxcare.1.

Record
CLSA-2026-1773101691
Updated
2026-11-02
OSVCLSA-2026-1773188136No score

TuxCare security update for qs (1 CVE)

TuxCare rebuilt qs to address 1 CVE. Fixed in 2.4.2-tuxcare.2.

Record
CLSA-2026-1773188136
Updated
2026-11-02
OSVCLSA-2026-1773274549No score

TuxCare security update for qs (2 CVEs)

TuxCare rebuilt qs to address 2 CVEs. Fixed in 2.2.5-tuxcare.1.

Record
CLSA-2026-1773274549
Updated
2026-11-02
OSVCLSA-2026-1773274550No score

TuxCare security update for qs (3 CVEs)

TuxCare rebuilt qs to address 3 CVEs. Fixed in 2.3.3-tuxcare.1.

Record
CLSA-2026-1773274550
Updated
2026-11-02
OSVCLSA-2026-1775694706No score

TuxCare security update for qs (4 CVEs)

TuxCare rebuilt qs to address 4 CVEs. Fixed in 0.5.1-tuxcare.1.

Record
CLSA-2026-1775694706
Updated
2026-11-02
OSVCLSA-2026-1784509773No score

TuxCare security update for qs (2 CVEs)

TuxCare rebuilt qs to address 2 CVEs. Fixed in 5.2.1-tuxcare.1.

Record
CLSA-2026-1784509773
Updated
2026-11-02
OSVCLSA-2026-1784509812No score

TuxCare security update for qs (1 CVE)

TuxCare rebuilt qs to address 1 CVE. Fixed in 3.1.0-tuxcare.1.

Record
CLSA-2026-1784509812
Updated
2026-11-02
OSVCLSA-2026-1784596277No score

TuxCare security update for qs (1 CVE)

TuxCare rebuilt qs to address 1 CVE. Fixed in 2.2.4-tuxcare.1.

Record
CLSA-2026-1784596277
Updated
2026-11-02
OSVCLSA-2026-1791373797No score

TuxCare security update for qs (5 CVEs)

TuxCare rebuilt qs to address 5 CVEs. Fixed in 0.6.5-tuxcare.1.

Record
CLSA-2026-1791373797
Updated
2026-11-02
OSVCLSA-2026-1792476180No score

TuxCare security update for qs (4 CVEs)

TuxCare rebuilt qs to address 4 CVEs. Fixed in 6.2.1-tuxcare.1.

Record
CLSA-2026-1792476180
Updated
2026-11-02
OSVCLSA-2026-1793015893No score

TuxCare security update for qs (5 CVEs)

TuxCare rebuilt qs to address 5 CVEs. Fixed in 0.4.2-tuxcare.1.

Record
CLSA-2026-1793015893
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2017-1000048No score

CVE-2017-1000048 in @rootio/qs - Patched by Root

Root has patched CVE-2017-1000048 in the @rootio/qs package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2017-1000048
Updated
2026-11-02

History

History
RecordedChangedSources
affected
factsOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 7 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open