{"id":"CVE-2022-24999","aliases":["ALSA-2023:0050","AZL-44307","AZL-45051","CLSA-2026-1771459792","CLSA-2026-1773101688","CLSA-2026-1773101691","CLSA-2026-1773274549","CLSA-2026-1773274550","CLSA-2026-1773274551","CLSA-2026-1775694706","CLSA-2026-1784596269","CLSA-2026-1784596314","CLSA-2026-1784596344","CLSA-2026-1784769609","CLSA-2026-1791373797","CLSA-2026-1792447268","CLSA-2026-1792476180","CLSA-2026-1793015893","DEBIAN-CVE-2022-24999","DLA-3299-1","EUVD-2022-7366","GHSA-hrpp-h998-j3pp","MGASA-2023-0053","OESA-2024-1338","OESA-2024-1400","OESA-2024-1401","OESA-2024-1402","OESA-2024-1403","OESA-2024-1404","RHSA-2023:0050","RHSA-2023:0612","RHSA-2023:1533","RHSA-2023:1742","RLSA-2023:0050","UBUNTU-CVE-2022-24999","USN-7693-1"],"status":"published","title":"qs vulnerable to Prototype Pollution","description":"qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b\u0026a[__proto__]\u0026a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has \"deps: qs@6.9.7\" in its release description, is not vulnerable).","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.15695,"percentile":0.96901,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-1321"],"published":"2022-11-26T00:00:00Z","modified":"2026-11-05T05:36:30Z","exploits":[{"source":"pocgithub","id":"9pings/CVE-2022-24999","title":"9pings/CVE-2022-24999","date":"2022-04-18","url":"https://github.com/9pings/CVE-2022-24999"}],"fixes":[{"ecosystem":"npm","package":"qs","fixed_in":["6.10.3","6.9.7","6.8.3","6.7.3","6.6.1","6.5.3","6.4.1","6.3.3","6.2.4"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"qs","fixed_in":["2.4.2-tuxcare.3","5.2.1-tuxcare.2","3.1.0-tuxcare.2","2.2.4-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-qs","fixed_in":["6.10.3+ds+~6.9.7-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-qs","fixed_in":["6.10.3+ds+~6.9.7-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-qs","fixed_in":["6.10.3+ds+~6.9.7-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"node-qs","fixed_in":["6.5.2-1+deb10u1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"nodejs-qs","fixed_in":["6.5.3-1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"nodejs-qs","fixed_in":["6.5.1-2.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"nodejs-qs","fixed_in":["6.5.1-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"nodejs-qs","fixed_in":["6.5.1-2.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"nodejs-qs","fixed_in":["6.5.1-2.oe2203"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"nodejs-qs","fixed_in":["6.5.1-2.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"nodejs-qs","fixed_in":["6.5.1-2.oe2203sp2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-express","fixed_in":["4.17.1-2ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-qs","fixed_in":["6.9.1+ds-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.10.0"},{"fixed":"6.10.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.9.0"},{"fixed":"6.9.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.8.0"},{"fixed":"6.8.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.7.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6.0"},{"fixed":"6.6.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.0"},{"fixed":"6.5.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.0"},{"fixed":"6.4.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.0"},{"fixed":"6.3.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module_el8.7.0+3373+a4c18c43"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module_el8.7.0+3373+a4c18c43"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module_el8.7.0+3373+a4c18c43"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module_el8.7.0+3373+a4c18c43"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.20-2.module_el8.7.0+3373+a4c18c43"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23-3.module_el8.4.0+2522+3bd42762"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.17-1.14.21.1.2.module_el8.7.0+3373+a4c18c43"}]}],"bundled":5},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.3-5"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.2-tuxcare.0"},{"fixed":"1.2.2-tuxcare.1"}]}],"versions":["1.2.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0-tuxcare.0"},{"fixed":"5.2.0-tuxcare.1"}]}],"versions":["5.2.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0-tuxcare.0"},{"fixed":"5.1.0-tuxcare.1"}]}],"versions":["5.1.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.5-tuxcare.0"},{"fixed":"2.2.5-tuxcare.1"}]}],"versions":["2.2.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.3-tuxcare.0"},{"fixed":"2.3.3-tuxcare.1"}]}],"versions":["2.3.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.2-tuxcare.0"},{"fixed":"2.4.2-tuxcare.3"}]}],"versions":["2.4.2","2.4.2-tuxcare.1","2.4.2-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.1-tuxcare.0"},{"fixed":"0.5.1-tuxcare.1"}]}],"versions":["0.5.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.1-tuxcare.0"},{"fixed":"5.2.1-tuxcare.2"}]}],"versions":["5.2.1","5.2.1-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0-tuxcare.0"},{"fixed":"3.1.0-tuxcare.2"}]}],"versions":["3.1.0","3.1.0-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.4-tuxcare.0"},{"fixed":"2.2.4-tuxcare.2"}]}],"versions":["2.2.4","2.2.4-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0-tuxcare.0"},{"fixed":"6.7.0-tuxcare.2"}]}],"versions":["6.7.0","6.7.0-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.6.5-tuxcare.0"},{"fixed":"0.6.5-tuxcare.1"}]}],"versions":["0.6.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.1-tuxcare.0"},{"fixed":"6.5.1-tuxcare.1"}]}],"versions":["6.5.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1-tuxcare.0"},{"fixed":"6.2.1-tuxcare.1"}]}],"versions":["6.2.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.2-tuxcare.0"},{"fixed":"0.4.2-tuxcare.1"}]}],"versions":["0.4.2"],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"node-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10.3+ds+~6.9.7-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10.3+ds+~6.9.7-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10.3+ds+~6.9.7-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"node-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.2-1+deb10u1"}]}],"versions":["6.5.2-1"]},{"source":"osv","ecosystem":"npm","package":"qs","ranges":[{"type":"SEMVER","events":[{"introduced":"6.10.0"},{"fixed":"6.10.3"}]}]},{"source":"osv","ecosystem":"npm","package":"qs","ranges":[{"type":"SEMVER","events":[{"introduced":"6.9.0"},{"fixed":"6.9.7"}]}]},{"source":"osv","ecosystem":"npm","package":"qs","ranges":[{"type":"SEMVER","events":[{"introduced":"6.8.0"},{"fixed":"6.8.3"}]}]},{"source":"osv","ecosystem":"npm","package":"qs","ranges":[{"type":"SEMVER","events":[{"introduced":"6.7.0"},{"fixed":"6.7.3"}]}]},{"source":"osv","ecosystem":"npm","package":"qs","ranges":[{"type":"SEMVER","events":[{"introduced":"6.6.0"},{"fixed":"6.6.1"}]}]},{"source":"osv","ecosystem":"npm","package":"qs","ranges":[{"type":"SEMVER","events":[{"introduced":"6.5.0"},{"fixed":"6.5.3"}]}]},{"source":"osv","ecosystem":"npm","package":"qs","ranges":[{"type":"SEMVER","events":[{"introduced":"6.4.0"},{"fixed":"6.4.1"}]}]},{"source":"osv","ecosystem":"npm","package":"qs","ranges":[{"type":"SEMVER","events":[{"introduced":"6.3.0"},{"fixed":"6.3.3"}]}]},{"source":"osv","ecosystem":"npm","package":"qs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.2.4"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"nodejs-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.3-1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"nodejs-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.1-2.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"nodejs-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.1-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"nodejs-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.1-2.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"nodejs-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.1-2.oe2203"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"nodejs-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.1-2.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"nodejs-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.1-2.oe2203sp2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+6519+9f98ed83"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.21.1-3.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.21.1-3.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.21.1-3.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.21.1-3.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.21.1-3.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-2.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.17-14.21.1.3.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-3.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+6519+9f98ed83"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-3.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+6519+9f98ed83"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module+el8.7.0+1116+bd2a84b4"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-2.module+el8.7.0+1108+49363b0d"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.7.0+1071+4bdda2a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+100+234774f7"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.5.0+733+de4fee6c"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.1-2ubuntu0.1~esm2"}]}],"versions":["4.17.1-1","4.17.1-2","4.17.1-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.1+ds-1ubuntu0.1~esm1"}]}],"versions":["6.5.2-1","6.9.0+ds-1","6.9.1+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.1+ds-1ubuntu0.1~esm1"}]}],"versions":["6.5.2-1","6.9.0+ds-1","6.9.1+ds-1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"openjsf","product":"express"},{"vendor":"qs_project","product":"qs"}],"references":[{"url":"https://github.com/expressjs/express/releases/tag/4.17.3","tags":["x_transferred","Release Notes","web","article","report"]},{"url":"https://github.com/ljharb/qs/pull/428","tags":["x_transferred","Issue Tracking","Patch","fix","web","article","report"]},{"url":"https://github.com/n8tz/CVE-2022-24999","tags":["x_transferred","Exploit","Third Party Advisory","package","web","article","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/01/msg00039.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://security.netapp.com/advisory/ntap-20230908-0005/","tags":["x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24999","tags":["web","advisory"]},{"url":"https://github.com/ljharb/qs/commit/4310742efbd8c03f6495f07906b45213da0a32ec","tags":["web"]},{"url":"https://github.com/ljharb/qs/commit/727ef5d34605108acb3513f72d5435972ed15b68","tags":["web"]},{"url":"https://github.com/ljharb/qs/commit/73205259936317b40f447c5cdb71c5b341848e1b","tags":["web"]},{"url":"https://github.com/ljharb/qs/commit/8b4cc14cda94a5c89341b77e5fe435ec6c41be2d","tags":["web"]},{"url":"https://github.com/ljharb/qs/commit/ba24e74dd17931f825adb52f5633e48293b584e1","tags":["web"]},{"url":"https://github.com/ljharb/qs/commit/e799ba57e573a30c14b67c1889c7c04d508b9105","tags":["web"]},{"url":"https://github.com/ljharb/qs/commit/ed0f5dcbef4b168a8ae299d78b1e4a2e9b1baf1f","tags":["web"]},{"url":"https://github.com/ljharb/qs/commit/f945393cfe442fe8c6e62b4156fd35452c0686ee","tags":["web"]},{"url":"https://github.com/ljharb/qs/commit/fc3682776670524a42e19709ec4a8138d0d7afda","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20230908-0005","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hrpp-h998-j3pp"},{"url":"https://access.redhat.com/errata/RHSA-2023:0050","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44906","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-0235","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24999","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-3517","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-43548","tags":["report"]},{"url":"https://bugzilla.redhat.com/2044591","tags":["report"]},{"url":"https://bugzilla.redhat.com/2066009","tags":["report"]},{"url":"https://bugzilla.redhat.com/2134609","tags":["report"]},{"url":"https://bugzilla.redhat.com/2140911","tags":["report"]},{"url":"https://bugzilla.redhat.com/2142821","tags":["report"]},{"url":"https://bugzilla.redhat.com/2150323","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-0050.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24999.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-24999","tags":["advisory"]},{"url":"https://github.com/ljharb/qs","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2023-0053.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31494","tags":["report"]},{"url":"https://www.debian.org/lts/security/2023/dla-3299","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1338","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1400","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1401","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1402","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1403","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1404","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044591","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2066009","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2134609","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2140911","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2142821","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2150323","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0050.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44906","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44906","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xvch-5gv4-984h","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0235","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0235","tags":["advisory"]},{"url":"https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3517","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3517","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24999","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-43548","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43548","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2023:0612","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2009880","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2129806","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2156324","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0612.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-35065","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-35065","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35065","tags":["advisory"]},{"url":"https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1533","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2130518","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2142823","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2165824","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2168631","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2170644","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2171935","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172217","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2175828","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1533.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-4904","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-4904","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4904","tags":["advisory"]},{"url":"https://github.com/c-ares/c-ares/issues/496","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25881","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25881","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25881","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-35256","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-35256","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-35256","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/#http-request-smuggling-due-to-incorrect-parsing-of-header-fields-medium-cve-2022-35256","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-38900","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-38900","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38900","tags":["advisory"]},{"url":"https://github.com/SamVerschueren/decode-uri-component/issues/5","tags":["article"]},{"url":"https://github.com/advisories/GHSA-w573-4hg7-7wgq","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-23918","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-23918","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23918","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-23920","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-23920","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23920","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1742","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040846","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040856","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040862","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2142822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2175827","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1742.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44531","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44531","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44531","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44532","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44532","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44532","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44533","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44533","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44533","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-21824","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21824","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21824","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:0050","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-24999","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7693-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-24999","description":"qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b\u0026a[__proto__]\u0026a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has \"deps: qs@6.9.7\" in its release description, is not vulnerable).","status":"published","published":"2022-11-26T00:00:00Z","modified":"2025-04-29T13:56:42.673Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:34:34.576287Z"}],"euvd":[{"id":"EUVD-2022-7366","description":"qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b\u0026a[__proto__]\u0026a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has \"deps: qs@6.9.7\" in its release description, is not vulnerable).","status":"published","published":"2022-11-26T00:00:00Z","modified":"2025-04-29T13:56:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:00.974547Z"}],"ghsa":[{"id":"GHSA-hrpp-h998-j3pp","title":"qs vulnerable to Prototype Pollution","description":"qs before 6.10.3 allows attackers to cause a Node process hang because an `__ proto__` key can be used. In many typical web framework use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as `a[__proto__]=b\u0026a[__proto__]\u0026a[length]=100000000`. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4.","status":"published","published":"2022-11-27T00:30:50Z","modified":"2025-04-29T15:41:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:38:41.402125Z"}],"nvd":[{"id":"CVE-2022-24999","description":"qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b\u0026a[__proto__]\u0026a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has \"deps: qs@6.9.7\" in its release description, is not vulnerable).","status":"published","published":"2022-11-26T22:15:10.153Z","modified":"2026-06-17T04:32:55.2Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:07:32.827264Z"}],"osv":[{"id":"AZL-44307","title":"CVE-2022-24999 affecting package nodejs-nodemon 2.0.3-5","description":"qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b\u0026a[__proto__]\u0026a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has \"deps: qs@6.9.7\" in its release description, is not vulnerable).","status":"published","published":"2022-11-26T22:15:10Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:20.107976Z"},{"id":"AZL-45051","title":"CVE-2022-24999 affecting package js-jquery 3.5.0-4","description":"qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b\u0026a[__proto__]\u0026a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has \"deps: qs@6.9.7\" in its release description, is not vulnerable).","status":"published","published":"2022-11-26T22:15:10Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:20.321068Z"},{"id":"CVE-2022-24999","description":"qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b\u0026a[__proto__]\u0026a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has \"deps: qs@6.9.7\" in its release description, is not vulnerable).","status":"published","published":"2022-11-26T00:00:00Z","modified":"2026-10-28T02:30:21.952745214Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:24.428403Z"},{"id":"DEBIAN-CVE-2022-24999","description":"qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b\u0026a[__proto__]\u0026a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has \"deps: qs@6.9.7\" in its release description, is not vulnerable).","status":"published","published":"2022-11-26T22:15:10.153Z","modified":"2026-11-03T08:02:45.400855866Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T08:24:39.643572Z"},{"id":"GHSA-hrpp-h998-j3pp","title":"qs vulnerable to Prototype Pollution","description":"qs before 6.10.3 allows attackers to cause a Node process hang because an `__ proto__` key can be used. In many typical web framework use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as `a[__proto__]=b\u0026a[__proto__]\u0026a[length]=100000000`. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4.","status":"published","published":"2022-11-27T00:30:50Z","modified":"2025-04-29T15:41:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:49.621585Z"},{"id":"OESA-2024-1338","title":"nodejs-qs security update","description":"This is a query string parser for node and the browser supporting nesting, as it was removed from 0.3.x, so this library provides the previous and commonly desired behavior (and twice as fast). Used by express, connect and others.\r\n\r\nSecurity Fix(es):\r\n\r\nqs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b\u0026amp;a[__proto__]\u0026amp;a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has \u0026quot;deps: qs@6.9.7\u0026quot; in its release description, is not vulnerable).(CVE-2022-24999)","status":"published","published":"2024-03-29T11:06:47Z","modified":"2026-08-18T01:18:20.115178873Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1400","title":"nodejs-qs security update","description":"This is a query string parser for node and the browser supporting nesting, as it was removed from 0.3.x, so this library provides the previous and commonly desired behavior (and twice as fast). Used by express, connect and others.\r\n\r\nSecurity Fix(es):\r\n\r\nqs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b\u0026amp;a[__proto__]\u0026amp;a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has \u0026quot;deps: qs@6.9.7\u0026quot; in its release description, is not vulnerable).(CVE-2022-24999)","status":"published","published":"2024-04-12T11:06:51Z","modified":"2026-08-18T01:18:20.432437029Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1401","title":"nodejs-qs security update","description":"This is a query string parser for node and the browser supporting nesting, as it was removed from 0.3.x, so this library provides the previous and commonly desired behavior (and twice as fast). Used by express, connect and others.\r\n\r\nSecurity Fix(es):\r\n\r\nqs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b\u0026amp;a[__proto__]\u0026amp;a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has \u0026quot;deps: qs@6.9.7\u0026quot; in its release description, is not vulnerable).(CVE-2022-24999)","status":"published","published":"2024-04-12T11:06:51Z","modified":"2026-08-18T01:18:20.461598379Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1402","title":"nodejs-qs security update","description":"This is a query string parser for node and the browser supporting nesting, as it was removed from 0.3.x, so this library provides the previous and commonly desired behavior (and twice as fast). Used by express, connect and others.\r\n\r\nSecurity Fix(es):\r\n\r\nqs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b\u0026amp;a[__proto__]\u0026amp;a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has \u0026quot;deps: qs@6.9.7\u0026quot; in its release description, is not vulnerable).(CVE-2022-24999)","status":"published","published":"2024-04-12T11:06:51Z","modified":"2026-08-18T01:18:20.55008114Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1403","title":"nodejs-qs security update","description":"This is a query string parser for node and the browser supporting nesting, as it was removed from 0.3.x, so this library provides the previous and commonly desired behavior (and twice as fast). Used by express, connect and others.\r\n\r\nSecurity Fix(es):\r\n\r\nqs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b\u0026amp;a[__proto__]\u0026amp;a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has \u0026quot;deps: qs@6.9.7\u0026quot; in its release description, is not vulnerable).(CVE-2022-24999)","status":"published","published":"2024-04-12T11:06:51Z","modified":"2026-08-18T01:18:20.46464302Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1404","title":"nodejs-qs security update","description":"This is a query string parser for node and the browser supporting nesting, as it was removed from 0.3.x, so this library provides the previous and commonly desired behavior (and twice as fast). Used by express, connect and others.\r\n\r\nSecurity Fix(es):\r\n\r\nqs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b\u0026amp;a[__proto__]\u0026amp;a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has \u0026quot;deps: qs@6.9.7\u0026quot; in its release description, is not vulnerable).(CVE-2022-24999)","status":"published","published":"2024-04-12T11:06:51Z","modified":"2026-08-18T01:18:20.746686859Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"RHSA-2023:0050","title":"Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update","status":"published","published":"2024-10-22T00:31:35Z","modified":"2026-10-16T10:01:53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2023:0612","title":"Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update","status":"published","published":"2024-09-30T14:32:48Z","modified":"2026-10-16T10:01:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:1533","title":"Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update","status":"published","published":"2024-10-22T00:34:37Z","modified":"2026-10-13T10:04:00Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:1742","title":"Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update","status":"published","published":"2024-10-22T00:34:46Z","modified":"2026-10-16T10:02:02Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RLSA-2023:0050","title":"Moderate: nodejs:14 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.21.1), nodejs-nodemon (2.0.20).\n\nSecurity Fix(es):\n\n* minimist: prototype pollution (CVE-2021-44906)\n\n* node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n\n* express: \"qs\" prototype poisoning causes the hang of the node process (CVE-2022-24999)\n\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-01-09T14:24:14Z","modified":"2026-02-04T20:15:13.503848Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2022-24999","description":"qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b\u0026a[__proto__]\u0026a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has \"deps: qs@6.9.7\" in its release description, is not vulnerable).","status":"published","published":"2022-11-26T22:15:00Z","modified":"2026-02-04T02:32:30.861392Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"ALSA-2023:0050","title":"Moderate: nodejs:14 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.21.1), nodejs-nodemon (2.0.20).\n\nSecurity Fix(es):\n\n* minimist: prototype pollution (CVE-2021-44906)\n* node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n* express: \"qs\" prototype poisoning causes the hang of the node process (CVE-2022-24999)\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-01-09T00:00:00Z","modified":"2026-10-29T11:01:56.071099168Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"CLSA-2026-1771459792","title":"TuxCare security update for qs (2 CVEs)","description":"TuxCare rebuilt qs to address 2 CVEs. Fixed in 1.2.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-10-15T19:13:05.213442374Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1773101688","title":"TuxCare security update for qs (3 CVEs)","description":"TuxCare rebuilt qs to address 3 CVEs. Fixed in 5.2.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:11Z","modified":"2026-10-15T09:45:42.701636071Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1773101691","title":"TuxCare security update for qs (3 CVEs)","description":"TuxCare rebuilt qs to address 3 CVEs. Fixed in 5.1.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:11Z","modified":"2026-10-15T09:45:26.572797183Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1773274549","title":"TuxCare security update for qs (2 CVEs)","description":"TuxCare rebuilt qs to address 2 CVEs. Fixed in 2.2.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-22T14:30:57.683173592Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773274550","title":"TuxCare security update for qs (3 CVEs)","description":"TuxCare rebuilt qs to address 3 CVEs. Fixed in 2.3.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:28.76639633Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773274551","title":"TuxCare security update for qs (1 CVE)","description":"TuxCare rebuilt qs to address 1 CVE. Fixed in 2.4.2-tuxcare.3.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-22T14:30:59.835956469Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1775694706","title":"TuxCare security update for qs (4 CVEs)","description":"TuxCare rebuilt qs to address 4 CVEs. Fixed in 0.5.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:23Z","modified":"2026-10-22T14:31:00.423552886Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1784596269","title":"TuxCare security update for qs (1 CVE)","description":"TuxCare rebuilt qs to address 1 CVE. Fixed in 5.2.1-tuxcare.2.","status":"published","published":"2026-08-04T14:52:45Z","modified":"2026-10-15T09:45:58.68371247Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1784596314","title":"TuxCare security update for qs (1 CVE)","description":"TuxCare rebuilt qs to address 1 CVE. Fixed in 3.1.0-tuxcare.2.","status":"published","published":"2026-08-04T14:52:45Z","modified":"2026-10-15T09:47:53.904394937Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784596344","title":"TuxCare security update for qs (1 CVE)","description":"TuxCare rebuilt qs to address 1 CVE. Fixed in 2.2.4-tuxcare.2.","status":"published","published":"2026-08-04T14:52:45Z","modified":"2026-10-15T09:47:36.241356289Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784769609","title":"TuxCare security update for qs (3 CVEs)","description":"TuxCare rebuilt qs to address 3 CVEs. Fixed in 6.7.0-tuxcare.2.","status":"published","published":"2026-08-04T14:52:48Z","modified":"2026-10-15T09:47:36.457563414Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1791373797","title":"TuxCare security update for qs (5 CVEs)","description":"TuxCare rebuilt qs to address 5 CVEs. Fixed in 0.6.5-tuxcare.1.","status":"published","published":"2026-10-07T11:49:57Z","modified":"2026-10-15T09:47:39.392238291Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1792447268","title":"TuxCare security update for qs (3 CVEs)","description":"TuxCare rebuilt qs to address 3 CVEs. Fixed in 6.5.1-tuxcare.1.","status":"published","published":"2026-10-19T22:01:08Z","modified":"2026-10-20T01:45:09.149779634Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792476180","title":"TuxCare security update for qs (4 CVEs)","description":"TuxCare rebuilt qs to address 4 CVEs. Fixed in 6.2.1-tuxcare.1.","status":"published","published":"2026-10-20T06:03:00Z","modified":"2026-10-20T07:15:09.283036707Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1793015893","title":"TuxCare security update for qs (5 CVEs)","description":"TuxCare rebuilt qs to address 5 CVEs. Fixed in 0.4.2-tuxcare.1.","status":"published","published":"2026-10-26T11:58:13Z","modified":"2026-10-26T13:30:02.537397809Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"DLA-3299-1","title":"node-qs - security update","status":"published","published":"2023-01-30T00:00:00Z","modified":"2026-03-09T01:23:24.118639Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"MGASA-2023-0053","title":"Updated nodejs-qs packages fix security vulnerability","description":"nodejs qs before 6.10.3, as used in Express before 4.17.3 and other\nproducts, allows attackers to cause a Node process hang for an Express\napplication because an __ proto__ key can be used. In many typical Express\nuse cases, an unauthenticated remote attacker can place the attack payload\nin the query string of the URL that is used to visit the application, such\nas a[__proto__]=b\u0026a[__proto__]\u0026a[length]=100000000.  (CVE-2022-24999)\n","status":"published","published":"2023-02-20T21:25:36Z","modified":"2026-04-16T04:42:04.870751818Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"USN-7693-1","title":"node-qs vulnerability","description":"Nathanael Braun and Johan Brissaud discovered that qs was vulnerable\nto prototype pollution. A remote attacker could possibly use this issue\nto cause a denial of service.","status":"published","published":"2025-08-14T01:40:12Z","modified":"2026-02-10T04:49:42Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}