CVE-2014-7191
Denial-of-Service Memory Exhaustion in qs
CVE-2014-7191 is a medium vulnerability (CVSS 5.0) in Nodejs Node.js, published October 19, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.31%, the 95th percentile. Fixed in qs 1.0.0.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 8.31%EPSS, 95th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.0.0qs +11 more
Description
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qsnpm | before 1.0.0 | 1.0.0 |
qsTuxCare:npm From an advisory covering 4 CVEs | 0.5.1-tuxcare.0 up to 0.5.1-tuxcare.1, plus listed versions 0.5.1 | 0.5.1-tuxcare.1 |
qsTuxCare:npm From an advisory covering 5 CVEs | 0.6.5-tuxcare.0 up to 0.6.5-tuxcare.1, plus listed versions 0.6.5 | 0.6.5-tuxcare.1 |
qsTuxCare:npm From an advisory covering 5 CVEs | 0.4.2-tuxcare.0 up to 0.4.2-tuxcare.1, plus listed versions 0.4.2 | 0.4.2-tuxcare.1 |
node-qsDebian:12 | before 2.2.4-1 | 2.2.4-1 |
node-qsDebian:13 | before 2.2.4-1 | 2.2.4-1 |
node-qsDebian:14 | before 2.2.4-1 | 2.2.4-1 |
nodejs010-node-gypRed Hat:rhel_software_collections:2::el6 | before 0:3.2.0-3.el6 | 0:3.2.0-3.el6 |
nodejs010-nodejs-qsRed Hat:rhel_software_collections:2::el6 | before 0:0.6.5-5.el6 | 0:0.6.5-5.el6 |
nodejs010-node-gypRed Hat:rhel_software_collections:2::el7 | before 0:3.2.0-3.el7 | 0:3.2.0-3.el7 |
nodejs010-nodejs-qsRed Hat:rhel_software_collections:2::el7 | before 0:0.6.5-5.el7 | 0:0.6.5-5.el7 |
node-qsUbuntu:Pro:14.04:LTS | before 0.6.5-1ubuntu0.1~esm1, plus listed versions 0.4.2-10.6.5-1 | 0.6.5-1ubuntu0.1~esm1 |
What each source reports
NVD Score used
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.
- Record
CVE-2014-7191- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE ListNo score
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.
- Record
CVE-2014-7191- Updated
- 2026-11-02
EUVDEUVD-2017-0262No score
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.
- Record
EUVD-2017-0262- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jjv7-qpx3-h62qNo score
Denial-of-Service Memory Exhaustion in qs
Versions prior to 1.0 of qs are affected by a denial of service condition. This condition is triggered by parsing a crafted string that deserializes into very large sparse arrays, resulting in the process running out of memory and eventually crashing.
Recommendation
Update to version 1.0.0 or later.
- Record
GHSA-jjv7-qpx3-h62q- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVCLSA-2026-1775694706No score
TuxCare security update for qs (4 CVEs)
TuxCare rebuilt qs to address 4 CVEs. Fixed in 0.5.1-tuxcare.1.
- Record
CLSA-2026-1775694706- Updated
- 2026-11-02
OSVCLSA-2026-1791373797No score
TuxCare security update for qs (5 CVEs)
TuxCare rebuilt qs to address 5 CVEs. Fixed in 0.6.5-tuxcare.1.
- Record
CLSA-2026-1791373797- Updated
- 2026-11-02
Show 5 moreShow less
OSVCLSA-2026-1793015893No score
TuxCare security update for qs (5 CVEs)
TuxCare rebuilt qs to address 5 CVEs. Fixed in 0.4.2-tuxcare.1.
- Record
CLSA-2026-1793015893- Updated
- 2026-11-02
OSVNo score
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.
- Record
CVE-2014-7191- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-7191No score
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.
- Record
DEBIAN-CVE-2014-7191- Updated
- 2026-11-02
OSVGHSA-jjv7-qpx3-h62qNo score
Denial-of-Service Memory Exhaustion in qs
Versions prior to 1.0 of qs are affected by a denial of service condition. This condition is triggered by parsing a crafted string that deserializes into very large sparse arrays, resulting in the process running out of memory and eventually crashing.
Recommendation
Update to version 1.0.0 or later.
- Record
GHSA-jjv7-qpx3-h62q- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-7191No score
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.
- Record
UBUNTU-CVE-2014-7191- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
secunia.com/advisories/60026
github.com/visionmedia/node-querystring/issues/104
access.redhat.com/errata/RHSA-2016:1380
nodesecurity.io/advisories/qs_dos_memory_exhaustion
Show 16 moreShow less
www-01.ibm.com/support/docview.wss?uid=swg21687928
exchange.xforce.ibmcloud.com/vulnerabilities/96729
nvd.nist.gov/vuln/detail/CVE-2014-7191
npmjs.com/advisories/29
security-tracker.debian.org/tracker/CVE-2014-7191
bugzilla.redhat.com/show_bug.cgi?id=1146054
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1380.json
cve.org/CVERecord?id=CVE-2014-7191
ubuntu.com/security/CVE-2014-7191