Description
the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 2 | rh-nodejs6-nodejs-qs | 6.2.3-1.el6 | RHSA-2017:2672 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | nodejs-nodemon | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | qs | < 6.0.4 | 6.0.4 | GHSA-gqgv-6jq5-jjj9 |
| npm | qs | >= 6.1.0, < 6.1.2 | 6.1.2 | GHSA-gqgv-6jq5-jjj9 |
| npm | qs | >= 6.2.0, < 6.2.3 | 6.2.3 | GHSA-gqgv-6jq5-jjj9 |
| npm | qs | >= 6.3.0, < 6.3.2 | 6.3.2 | GHSA-gqgv-6jq5-jjj9 |
Advisories 2
- RHSA-2017:2672 Red Hat Security Advisory: rh-nodejs6-nodejs-qs security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- WID-SEC-2024-1591 Juniper JUNOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2024
References
- https://github.com/ljharb/qs/issues/200
- RHSA-2017:2672 vendor-advisory