Description
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-qs | 6.10.3+ds+~6.9.7-1 | — |
| Debian 13 | node-qs | 6.10.3+ds+~6.9.7-1 | — |
| Debian 12 | node-qs | 6.10.3+ds+~6.9.7-1 | — |
| Debian 10 | node-qs | 6.5.2-1+deb10u1 | DLA-3299-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | node-express | 4.17.1-2ubuntu0.1~esm2 | — |
| Ubuntu Pro 20.04 LTS | node-qs | 6.9.1+ds-1ubuntu0.1~esm1 | USN-7693-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | nodejs +3 | 1:14.21.1-2.module+el8.7.0+17528+a329cd47 | RHSA-2023:0050 |
| RHEL 8 | nodejs-nodemon | 2.0.20-2.module+el8.7.0+17528+a329cd47 | RHSA-2023:0050 |
| RHEL 8 | nodejs-packaging | 23-3.module+el8.3.0+6519+9f98ed83 | RHSA-2023:0050 |
| RHEL 8 | npm | 1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47 | RHSA-2023:0050 |
| RHEL 3 | rh-nodejs14-nodejs +3 | 14.21.1-3.el7 | RHSA-2023:0612 |
| RHEL 3 | rh-nodejs14-nodejs-nodemon | 2.0.20-2.el7 | RHSA-2023:0612 |
| RHEL 3 | rh-nodejs14-npm | 6.14.17-14.21.1.3.el7 | RHSA-2023:0612 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8.6 EUS | nodejs +3 | 1:14.21.3-1.module+el8.6.0+18532+cbe6f646 | RHSA-2023:1742 |
| RHEL 8.6 EUS | nodejs-nodemon | 2.0.20-3.module+el8.6.0+18532+cbe6f646 | RHSA-2023:1742 |
| RHEL 8.6 EUS | nodejs-packaging | 23-3.module+el8.3.0+6519+9f98ed83 | RHSA-2023:1742 |
| RHEL 8.6 EUS | npm | 1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646 | RHSA-2023:1742 |
| RHEL 8.4 EUS | nodejs +3 | 1:14.21.3-1.module+el8.4.0+18317+43f5ac16 | RHSA-2023:1533 |
| RHEL 8.4 EUS | nodejs-nodemon | 2.0.20-3.module+el8.4.0+18317+43f5ac16 | RHSA-2023:1533 |
| RHEL 8.4 EUS | nodejs-packaging | 23-3.module+el8.3.0+6519+9f98ed83 | RHSA-2023:1533 |
| RHEL 8.4 EUS | npm | 1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16 | RHSA-2023:1533 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | nodejs +3 | 1:14.21.1-2.module_el8.7.0+3373+a4c18c43 | ALSA-2023:0050 |
| AlmaLinux 8 | nodejs-nodemon | 2.0.20-2.module_el8.7.0+3373+a4c18c43 | ALSA-2023:0050 |
| AlmaLinux 8 | nodejs-packaging | 23-3.module_el8.4.0+2522+3bd42762 | ALSA-2023:0050 |
| AlmaLinux 8 | npm | 1:6.14.17-1.14.21.1.2.module_el8.7.0+3373+a4c18c43 | ALSA-2023:0050 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | nodejs | 1:14.21.1-2.module+el8.7.0+1116+bd2a84b4 | RLSA-2023:0050 |
| Rocky Linux 8 | nodejs-nodemon | 2.0.20-2.module+el8.7.0+1108+49363b0d | RLSA-2023:0050 |
| Rocky Linux 8 | nodejs-packaging | 23-3.module+el8.3.0+100+234774f7 | RLSA-2023:0050 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | js-jquery +1 | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | nodejs +3 | 1:14.21.1-2.module+el8.7.0+20895+79a25710 | ELSA-2023-0050 |
| Oracle Linux 8 | nodejs-nodemon | 2.0.20-2.module+el8.7.0+20895+79a25710 | ELSA-2023-0050 |
| Oracle Linux 8 | nodejs-packaging | 23-3.module+el8.3.0+7818+6cd30d85 | ELSA-2023-0050 |
| Oracle Linux 8 | npm | 1:6.14.17-1.14.21.1.2.module+el8.7.0+20895+79a25710 | ELSA-2023-0050 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
9pings/CVE-2022-24999 ★ 8 · Apr 18, 2022
"qs" prototype poisoning vulnerability ( CVE-2022-24999 )
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | qs | >= 6.10.0, < 6.10.3 | 6.10.3 | GHSA-hrpp-h998-j3pp |
| npm | qs | >= 6.9.0, < 6.9.7 | 6.9.7 | GHSA-hrpp-h998-j3pp |
| npm | qs | >= 6.8.0, < 6.8.3 | 6.8.3 | GHSA-hrpp-h998-j3pp |
| npm | qs | >= 6.7.0, < 6.7.3 | 6.7.3 | GHSA-hrpp-h998-j3pp |
| npm | qs | >= 6.6.0, < 6.6.1 | 6.6.1 | GHSA-hrpp-h998-j3pp |
| npm | qs | >= 6.5.0, < 6.5.3 | 6.5.3 | GHSA-hrpp-h998-j3pp |
| npm | qs | >= 6.4.0, < 6.4.1 | 6.4.1 | GHSA-hrpp-h998-j3pp |
| npm | qs | >= 6.3.0, < 6.3.3 | 6.3.3 | GHSA-hrpp-h998-j3pp |
| npm | qs | < 6.2.4 | 6.2.4 | GHSA-hrpp-h998-j3pp |
Advisories 17
- ALSA-2023:0050 Moderate: nodejs:14 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2023:1742 Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:0612 Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:0050 Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2023:1533 Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2023-1350 Splunk Splunk Enterprise: Mehrere Schwachstellen in Komponenten von Drittanbietern BSI CERT-Bund (WID) · Jul 1, 2026
- DLA-3299-1 node-qs - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-7693-1 node-qs vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- RLSA-2023:0050 Moderate: nodejs:14 security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 4, 2026
- WID-SEC-2023-2229 Splunk Splunk Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
- 9AKK108470A8565 RMC-100 Vulnerability in the Web UI (REST Interface) ABB PSIRT · Mar 11, 2025
- ICSA-25-084-01 ABB RMC-100 CISA ICS & IT advisories · Mar 11, 2025
- WID-SEC-2023-0809 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 19, 2024
- WID-SEC-2023-1295 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 15, 2023
- WID-SEC-2023-0822 HCL BigFix: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Apr 2, 2023
- WID-SEC-2023-0398 Red Hat Advanced Cluster Management for Kubernetes: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Mar 22, 2023
- ELSA-2023-0050 Moderate: nodejs:14 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jan 9, 2023