p PatchFirst

CVE-2022-24999

CVE-2022-24999

This page contains facts from public vulnerability sources. Check the original advisory before updating.

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).

CVSS 7.5 · High · EPSS 15.6% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • node-qs Debian:12

    Affected ranges
    • ECOSYSTEM: < 6.10.3+ds+~6.9.7-1

    Update to 6.10.3+ds+~6.9.7-1

  • node-qs Debian:13

    Affected ranges
    • ECOSYSTEM: < 6.10.3+ds+~6.9.7-1

    Update to 6.10.3+ds+~6.9.7-1

  • node-qs Debian:14

    Affected ranges
    • ECOSYSTEM: < 6.10.3+ds+~6.9.7-1

    Update to 6.10.3+ds+~6.9.7-1

  • qs npm

    Affected ranges
    • SEMVER: ≥ 6.10.0, < 6.10.3

    Update to 6.10.3

  • qs npm

    Affected ranges
    • SEMVER: ≥ 6.9.0, < 6.9.7

    Update to 6.9.7

  • qs npm

    Affected ranges
    • SEMVER: ≥ 6.8.0, < 6.8.3

    Update to 6.8.3

  • qs npm

    Affected ranges
    • SEMVER: ≥ 6.7.0, < 6.7.3

    Update to 6.7.3

  • qs npm

    Affected ranges
    • SEMVER: ≥ 6.6.0, < 6.6.1

    Update to 6.6.1

  • qs npm

    Affected ranges
    • SEMVER: ≥ 6.5.0, < 6.5.3

    Update to 6.5.3

  • qs npm

    Affected ranges
    • SEMVER: ≥ 6.4.0, < 6.4.1

    Update to 6.4.1

  • qs npm

    Affected ranges
    • SEMVER: ≥ 6.3.0, < 6.3.3

    Update to 6.3.3

  • qs npm

    Affected ranges
    • SEMVER: < 6.2.4

    Update to 6.2.4

  • node-express Ubuntu:Pro:20.04:LTS

    Versions
    • 4.17.1-1
    • 4.17.1-2
    • 4.17.1-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: < 4.17.1-2ubuntu0.1~esm2

    Update to 4.17.1-2ubuntu0.1~esm2

  • node-qs Ubuntu:Pro:20.04:LTS

    Versions
    • 6.5.2-1
    • 6.9.0+ds-1
    • 6.9.1+ds-1
    Affected ranges
    • ECOSYSTEM: < 6.9.1+ds-1ubuntu0.1~esm1

    Update to 6.9.1+ds-1ubuntu0.1~esm1

Original sources

Check your server →