qs Project qs 6.4.0 for Node.js

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:qs_project:qs:6.4.0:*:*:*:*:node.js:*:*

part: a version: 6.4.0 update: *

VendorQs Project (04e5401f-bb94-546b-bd3b-44c5d1cc7df5)
ProductQs (efd6e435-bc5c-5674-9e34-eaeb6fcbb1f7)
Edition*
Language*
Software edition*
Target softwarenode.js
Target hardware*
Other*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:github/ljharb/qs purl2cpe 2026-06-01 10:14:23.345309
pkg:npm/qs purl2cpe 2026-06-01 10:14:23.345311

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2022-24999 vulnerable 2026-06-08 05:41:45.080577 Details available
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).
Published: 2022-11-26T00:00:00.000Z
Updated: 2025-04-29T13:56:42.673Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.