Executive brief
qs is a widely-used JavaScript library for parsing URL query strings and JSON objects. Versions before 1.0.0 can be crashed by sending specially crafted requests with deeply nested JSON structures, causing the application to hang or become unresponsive. This allows attackers to disrupt service availability without authentication.
Technical details
The vulnerability is a denial-of-service flaw caused by excessive recursion (CWE-400: Uncontrolled Resource Consumption) in the JSON parsing logic of qs versions prior to 1.0.0. An attacker can exploit this by sending a request containing a deeply nested JSON string, which triggers recursive function calls that exhaust the call stack and block the event loop. The attack is network-accessible and requires no authentication or user interaction. The vulnerability was patched in version 1.0.0.
Affected products
- npm qs <1.0.0
Timeline
- 2018-10-09: disclosed
- 2014: patched: CVE-2014-10064 published; fix released in qs 1.0.0