CVE-2014-10064
CVE-2014-10064
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example, in a web application, other requests would not be processed while this blocking is occurring.
CVSS 7.5 · High · EPSS 1.4% · Fix available
- Published
- Updated
Affected products and versions
qs node module
- Versions
- <1.0.0: Affected
No fix published
node-qs Debian:12
- Affected ranges
- ECOSYSTEM: < 2.2.4-1
Update to 2.2.4-1
node-qs Debian:13
- Affected ranges
- ECOSYSTEM: < 2.2.4-1
Update to 2.2.4-1
node-qs Debian:14
- Affected ranges
- ECOSYSTEM: < 2.2.4-1
Update to 2.2.4-1
qs npm
- Affected ranges
- SEMVER: < 1.0.0
Update to 1.0.0
node-qs Ubuntu:Pro:14.04:LTS
- Versions
- 0.4.2-1
- 0.6.5-1
- 0.6.5-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published