Homepage

org.webjars.npm:qs@6.3.1

  • latest version

    6.16.0

  • latest non vulnerable version

    6.16.0

  • first published

    11 years ago

  • latest version published

    4 days ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.webjars.npm:qs package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Uncaught Exception

    org.webjars.npm:qs is a querystring parser that supports nesting and arrays, with a depth limit.

    Affected versions of this package are vulnerable to Uncaught Exception in the isBuffer() function in lib/utils.js, which calls obj.constructor.isBuffer(obj) without checking that it is callable, reached from stringify() at lib/stringify.js:127. An attacker can throw an uncaught TypeError that fails each request with HTTP 500, and terminates the worker process when stringify() runs in an unguarded async context, by supplying a query string such as x[constructor][isBuffer]=y that sets constructor.isBuffer to a non-function value. This requires the application to call qs.parse() with plainObjects: true or allowPrototypes: true, which preserves the constructor own property, and to then pass the parsed result to qs.stringify().

    How to fix Uncaught Exception?

    Upgrade org.webjars.npm:qs to version 6.16.0 or higher.

    [,6.16.0)
    • M
    Allocation of Resources Without Limits or Throttling

    org.webjars.npm:qs is a querystring parser that supports nesting and arrays, with a depth limit.

    Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the parseArrayValue() comma-parsing logic, which applies the arrayLimit and throwOnLimitExceeded checks only to flat values, so a bracket-key input such as a[]=1,2,3,4 is treated as non-flat and its comma-split inner array is wrapped after parsing without ever being length-checked. An attacker can exceed the configured array limit and force excessive memory allocation by supplying a query string or form body that uses the bracket-key comma form, for example a[]=1,2,3,.... This requires the application to parse untrusted input with the comma: true option enabled alongside a configured arrayLimit or throwOnLimitExceeded.

    How to fix Allocation of Resources Without Limits or Throttling?

    Upgrade org.webjars.npm:qs to version 6.16.0 or higher.

    [,6.16.0)
    • M
    NULL Pointer Dereference

    org.webjars.npm:qs is a querystring parser that supports nesting and arrays, with a depth limit.

    Affected versions of this package are vulnerable to NULL Pointer Dereference in the stringify() function, when processing arrays with the options arrayFormat: 'comma' and encodeValuesOnly: true that contain null or undefined elements. An attacker can cause errors by supplying mailcious input that results in these options being used with arrays containing null or undefined values. This only causes a crash if application code makes calls outside a request-handler error boundary (background jobs, startup paths, stream pipelines) or explicitly disables framework error handling.

    How to fix NULL Pointer Dereference?

    Upgrade org.webjars.npm:qs to version 6.15.3 or higher.

    [,6.15.3)
    • H
    Allocation of Resources Without Limits or Throttling

    org.webjars.npm:qs is a querystring parser that supports nesting and arrays, with a depth limit.

    Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the parseArrayValue function when the comma option is in use. An attacker can exhaust system memory by submitting a parameter containing a large number of comma-separated values, resulting in the allocation of excessively large arrays.

    Note: This is only exploitable if the comma option is explicitly set to true. arrayLimit is properly enforced for index and bracket notation.

    How to fix Allocation of Resources Without Limits or Throttling?

    Upgrade org.webjars.npm:qs to version 6.15.1 or higher.

    [,6.15.1)
    • H
    Allocation of Resources Without Limits or Throttling

    org.webjars.npm:qs is a querystring parser that supports nesting and arrays, with a depth limit.

    Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via improper enforcement of the arrayLimit option in bracket notation parsing. An attacker can exhaust server memory and cause application unavailability by submitting a large number of bracket notation parameters - like a[]=1&a[]=2 - in a single HTTP request.

    How to fix Allocation of Resources Without Limits or Throttling?

    Upgrade org.webjars.npm:qs to version 6.14.1 or higher.

    [,6.14.1)
    • H
    Prototype Poisoning

    org.webjars.npm:qs is a querystring parser that supports nesting and arrays, with a depth limit.

    Affected versions of this package are vulnerable to Prototype Poisoning which allows attackers to cause a Node process to hang, processing an Array object whose prototype has been replaced by one with an excessive length value.

    Note: In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000.

    How to fix Prototype Poisoning?

    Upgrade org.webjars.npm:qs to version 6.11.0 or higher.

    [,6.11.0)
    • H
    Prototype Override Protection Bypass

    org.webjars.npm:qs is a querystring parser that supports nesting and arrays, with a depth limit.

    Affected versions of this package are vulnerable to Prototype Override Protection Bypass. By default qs protects against attacks that attempt to overwrite an object's existing prototype properties, such as toString(), hasOwnProperty(),etc.

    From qs documentation:

    By default parameters that would overwrite properties on the object prototype are ignored, if you wish to keep the data from those fields either use plainObjects as mentioned above, or set allowPrototypes to true which will allow user input to overwrite those properties. WARNING It is generally a bad idea to enable this option as it can cause problems when attempting to use the properties that have been overwritten. Always be careful with this option.

    Overwriting these properties can impact application logic, potentially allowing attackers to work around security controls, modify data, make the application unstable and more.

    In versions of the package affected by this vulnerability, it is possible to circumvent this protection and overwrite prototype properties and functions by prefixing the name of the parameter with [ or ]. e.g. qs.parse("]=toString") will return {toString = true}, as a result, calling toString() on the object will throw an exception.

    Example:

    qs.parse('toString=foo', { allowPrototypes: false })
// {}

qs.parse("]=toString", { allowPrototypes: false })
// {toString = true} <== prototype overwritten

    For more information, you can check out our blog.

    How to fix Prototype Override Protection Bypass?

    Upgrade org.webjars.npm:qs to version 6.0.4, 6.1.2, 6.2.3, 6.3.2 or higher.

    [,6.0.4)[6.1.0,6.1.2)[6.2.0,6.2.3)[6.3.0,6.3.2)
    Go back to all versions of this package