qs npm Package Vulnerability: Denial of Service Risk
- Severity
- HIGH
- Affected component
- qs (npm)
- Affected versions
- >= 2.2.5, < 6.16.0 or < 6.14.1 or < 1.0.0 or < 6.0.4 or >= 6.1.0, < 6.1.2 or >= 6.2.0, < 6.2.3 or >= 6.3.0, < 6.3.2 or >= 6.10.0, < 6.10.3 or >= 6.9.0, < 6.9.7 or >= 6.8.0, < 6.8.3 or >= 6.7.0, < 6.7.3 or >= 6.6.0, < 6.6.1 or >= 6.5.0, < 6.5.3 or >= 6.4.0, < 6.4.1 or >= 6.3.0, < 6.3.3 or < 6.2.4 or < 1.0.0 or >= 6.11.1, < 6.15.2 or >= 6.7.0, < 6.14.2 or >= 6.14.2, < 6.16.0
- Patched version
- Not yet available
An early warning has been issued for a denial of service vulnerability in the qs npm package. This vulnerability affects specific versions of the package and requires immediate attention to assess and mitigate potential risks.
What happened
The qs npm package is reportedly vulnerable to a denial of service attack when using `qs.parse` with `plainObjects: true` or `allowPrototypes: true`. This vulnerability can be exploited via attacker-controlled input during a parse → stringify round-trip. The affected versions include >= 2.2.5, < 6.16.0 or < 6.14.1 or < 1.0.0 or < 6.0.4 or >= 6.1.0, < 6.1.2 or >= 6.2.0, < 6.2.3 or >= 6.3.0, < 6.3.2 or >= 6.10.0, < 6.10.3 or >= 6.9.0, < 6.9.7 or >= 6.8.0, < 6.8.3 or >= 6.7.0, < 6.7.3 or >= 6.6.0, < 6.6.1 or >= 6.5.0, < 6.5.3 or >= 6.4.0, < 6.4.1 or >= 6.3.0, < 6.3.3 or < 6.2.4 or < 1.0.0 or >= 6.11.1, < 6.15.2 or >= 6.7.0, < 6.14.2 or >= 6.14.2, < 6.16.0.
This vulnerability was first flagged on 2026-09-02T14:45:13+00:00 and is currently under investigation. It has not been exploited in the wild as of the latest reports.
What to do about it
- Avoid using `plainObjects: true` or `allowPrototypes: true` with `qs.parse` to mitigate the risk of denial of service.
- If these options are necessary, ensure that the input is trusted or sanitized properly.
- Check your project dependencies for affected versions of the qs package and consider updating or removing them if possible.
- Monitor the primary sources for updates on this vulnerability and any official fixes that may be released.
How 0Day would have caught this
qs is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if your project uses the qs npm package in versions >= 2.2.5, < 6.16.0 or < 6.14.1 or < 1.0.0 or < 6.0.4 or >= 6.1.0, < 6.1.2 or >= 6.2.0, < 6.2.3 or >= 6.3.0, < 6.3.2 or >= 6.10.0, < 6.10.3 or >= 6.9.0, < 6.9.7 or >= 6.8.0, < 6.8.3 or >= 6.7.0, < 6.7.3 or >= 6.6.0, < 6.6.1 or >= 6.5.0, < 6.5.3 or >= 6.4.0, < 6.4.1 or >= 6.3.0, < 6.3.3 or < 6.2.4 or < 1.0.0 or >= 6.11.1, < 6.15.2 or >= 6.7.0, < 6.14.2 or >= 6.14.2, < 6.16.0.
What should I do right now?
Avoid using `plainObjects: true` or `allowPrototypes: true` with `qs.parse`. If these options are necessary, ensure that the input is trusted or sanitized properly. Check your project dependencies for affected versions and consider updating or removing them if possible.
Has an official fix been released?
No official fix has been published yet. Monitor the primary sources for updates on this vulnerability and any official fixes that may be released.