Skip to content
OpenAdvisories
Unscored RHSA-2016:1380 1 CVE

Red Hat Security Advisory: nodejs010-node-gyp and nodejs010-nodejs-qs security and bug fix update

Published Sep 13, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · RHEL 2 rhel_software_collections:2::el6 nodejs010-node-gyp 0:3.2.0-3.el6
Red Hat · RHEL 2 rhel_software_collections:2::el6 nodejs010-nodejs-qs 0:0.6.5-5.el6
Red Hat · RHEL 2 rhel_software_collections:2::el7 nodejs010-node-gyp 0:3.2.0-3.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 nodejs010-nodejs-qs 0:0.6.5-5.el7

Vulnerabilities 1

  • High —
    CVE-2014-7191

    Denial-of-Service Memory Exhaustion in qs

    The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.

    qs node-qs node-qs Debian Ubuntu npm

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1146054
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1255594
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1380.json
  • report
    https://access.redhat.com/security/cve/CVE-2014-7191
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-7191
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-7191