Skip to content
OpenAdvisories
High DLA-3299-1 1 CVE

node-qs - security update

Published Jan 30, 2023 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 10 node-qs 6.5.2-1+deb10u1

Vulnerabilities 1

  • High 7.5
    CVE-2022-24999 Public exploit EPSS 16%

    qs vulnerable to Prototype Pollution

    qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can pl…

    js-jquery nodejs-nodemon qs node-qs Debian Ubuntu Azure Linux npm