Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWY5Y20tcDN3Ni14dnIz

Denial-of-Service Extended Event Loop Blocking in qs

Versions prior to 1.0.0 of qs are affected by a denial of service vulnerability that results from excessive recursion in parsing a deeply nested JSON string.

Recommendation

Update to version 1.0.0 or later

Permalink: https://github.com/advisories/GHSA-f9cm-p3w6-xvr3
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWY5Y20tcDN3Ni14dnIz
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 6 years ago
Updated: almost 2 years ago


EPSS Percentage: 0.00092
EPSS Percentile: 0.40449

Identifiers: GHSA-f9cm-p3w6-xvr3, CVE-2014-10064
References: Blast Radius: 0.0

Affected Packages

npm:qs
Dependent packages: 15,944
Dependent repositories: 2,110,964
Downloads: 310,160,920 last month
Affected Version Ranges: < 1.0.0
Fixed in: 1.0.0
All affected versions: 0.0.1, 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.1.0, 0.2.0, 0.3.0, 0.3.1, 0.3.2, 0.4.0, 0.4.1, 0.4.2, 0.5.0, 0.5.1, 0.5.2, 0.5.3, 0.5.4, 0.5.5, 0.5.6, 0.6.0, 0.6.1, 0.6.2, 0.6.3, 0.6.4, 0.6.5, 0.6.6
All unaffected versions: 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.2.0, 1.2.1, 1.2.2, 2.0.0, 2.1.0, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.3.0, 2.3.1, 2.3.2, 2.3.3, 2.4.0, 2.4.1, 2.4.2, 3.0.0, 3.1.0, 4.0.0, 5.0.0, 5.1.0, 5.2.0, 5.2.1, 6.0.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.1.0, 6.1.1, 6.1.2, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.4.0, 6.4.1, 6.5.0, 6.5.1, 6.5.2, 6.5.3, 6.6.0, 6.6.1, 6.7.0, 6.7.1, 6.7.2, 6.7.3, 6.8.0, 6.8.1, 6.8.2, 6.8.3, 6.9.0, 6.9.1, 6.9.2, 6.9.3, 6.9.4, 6.9.5, 6.9.6, 6.9.7, 6.10.0, 6.10.1, 6.10.2, 6.10.3, 6.10.4, 6.10.5, 6.11.0, 6.11.1, 6.11.2, 6.12.0, 6.12.1, 6.12.2, 6.12.3, 6.13.0, 6.13.1