qs npm Package Vulnerability: Denial of Service Threat
- Severity
- HIGH
- Affected component
- qs (npm)
- Affected versions
- >= 2.2.5, < 6.16.0 or < 6.14.1 or < 1.0.0 or < 6.0.4 or >= 6.1.0, < 6.1.2 or >= 6.2.0, < 6.2.3 or >= 6.3.0, < 6.3.2 or >= 6.10.0, < 6.10.3 or >= 6.9.0, < 6.9.7 or >= 6.8.0, < 6.8.3 or >= 6.7.0, < 6.7.3 or >= 6.6.0, < 6.6.1 or >= 6.5.0, < 6.5.3 or >= 6.4.0, < 6.4.1 or >= 6.3.0, < 6.3.3 or < 6.2.4 or < 1.0.0 or >= 6.11.1, < 6.15.2 or >= 6.7.0, < 6.14.2 or >= 6.14.2, < 6.16.0
- Patched version
- Not yet available
An early warning has been issued for a Denial of Service vulnerability in the qs npm package. Users of affected versions are advised to take immediate action.
What happened
An early warning has been issued regarding a vulnerability in the qs npm package that could lead to a Denial of Service attack. The issue arises when qs.stringify() calls utils.isBuffer() on every value it serializes, without checking if obj.constructor.isBuffer is callable. This oversight can result in a TypeError being thrown, potentially disrupting service. The vulnerability is under investigation and has not yet been exploited in the wild.
The affected versions of qs are complex and varied, including but not limited to versions >= 2.2.5, < 6.16.0 or < 6.14.1 or < 1.0.0 or < 6.0.4 or >= 6.1.0, < 6.1.2 or >= 6.2.0, < 6.2.3 or >= 6.3.0, < 6.3.2 or >= 6.10.0, < 6.10.3 or >= 6.9.0, < 6.9.7 or >= 6.8.0, < 6.8.3 or >= 6.7.0, < 6.7.3 or >= 6.6.0, < 6.6.1 or >= 6.5.0, < 6.5.3 or >= 6.4.0, < 6.4.1 or >= 6.3.0, < 6.3.3 or < 6.2.4 or < 1.0.0 or >= 6.11.1, < 6.15.2 or >= 6.7.0, < 6.14.2 or >= 6.14.2, < 6.16.0. Users of these versions should assess their exposure and consider upgrading.
What to do about it
- Upgrade to the latest version of qs to mitigate the risk of this vulnerability.
- Avoid using the plainObjects: true or allowPrototypes: true settings in qs.parse as a temporary measure.
- Monitor the primary sources for updates on this vulnerability and any official fixes that may be released.
How 0Day would have caught this
qs is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You may be affected if you are using a version of qs that falls within the specified vulnerable ranges. Check your qs version against the affected versions listed in the threat data.
What should I do right now?
Immediately upgrade to the latest version of qs and avoid using the plainObjects: true or allowPrototypes: true settings in qs.parse. Monitor the primary sources for updates.
Is there an official fix available?
No official fix has been published yet. Continue to monitor the primary sources for any updates on a patch.