Executive brief
The qs library is a popular Node.js module for parsing URL query strings used by web applications. Versions before 1.0.0 contain a flaw that allows attackers to cause a denial of service by sending specially crafted query strings that trigger excessive memory consumption, ultimately crashing the affected application.
Technical details
The vulnerability exists in how qs deserializes query strings into sparse arrays. When processing a maliciously crafted query string parameter, the parser creates extremely large sparse array objects that exhaust available memory. The attack requires no authentication or user interaction beyond making a network request to the application. This is an uncontrolled resource allocation vulnerability (CWE-400). The fix is to upgrade to qs version 1.0.0 or later, which addresses the improper handling of sparse arrays.
Affected products
- npm qs <1.0.0
Timeline
- 2014: disclosed: CVE-2014-7191 assigned
- 2014: patched: Version 1.0.0 released with fix
- 2017-10-24: advisory: GHSA-jjv7-qpx3-h62q published