Improper Encoding or Escaping of Outputqs is a querystring parser that supports nesting and arrays, with a depth limit.
Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the stringify function when the allowEmptyArrays option is enabled. When an object key contains special characters (such as &, =, or #) and its value is an empty array, the key is returned without encoding, allowing an attacker who controls a key name to inject arbitrary query-string parameters or URL fragments into the serialized output. A consumer that parses the resulting string will see attacker-controlled key-value pairs that were not present in the original object.
How to fix Improper Encoding or Escaping of Output? Upgrade qs to version 6.16.2 or higher.
| |
Uncaught Exceptionqs is a querystring parser that supports nesting and arrays, with a depth limit.
Affected versions of this package are vulnerable to Uncaught Exception via stringify when arrayFormat: 'comma' is used with array elements that have a non-callable toString property. Such elements - as produced by JSON.parse, or by qs.parse under allowPrototypes or plainObjects (which yields null-prototype objects) - cause Array.prototype.join or utils.encode to throw a TypeError: Cannot convert object to primitive value, crashing the process.
Note: This is only exploitable if the arrayFormat: 'comma' option is explicitly set.
How to fix Uncaught Exception? Upgrade qs to version 6.16.1 or higher.
| |
Uncaught Exceptionqs is a querystring parser that supports nesting and arrays, with a depth limit.
Affected versions of this package are vulnerable to Uncaught Exception in the isBuffer() function in lib/utils.js, which calls obj.constructor.isBuffer(obj) without checking that it is callable, reached from stringify() at lib/stringify.js:127. An attacker can throw an uncaught TypeError that fails each request with HTTP 500, and terminates the worker process when stringify() runs in an unguarded async context, by supplying a query string such as x[constructor][isBuffer]=y that sets constructor.isBuffer to a non-function value. This requires the application to call qs.parse() with plainObjects: true or allowPrototypes: true, which preserves the constructor own property, and to then pass the parsed result to qs.stringify().
How to fix Uncaught Exception? Upgrade qs to version 6.16.0 or higher.
| |
Allocation of Resources Without Limits or Throttlingqs is a querystring parser that supports nesting and arrays, with a depth limit.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the parseArrayValue() comma-parsing logic, which applies the arrayLimit and throwOnLimitExceeded checks only to flat values, so a bracket-key input such as a[]=1,2,3,4 is treated as non-flat and its comma-split inner array is wrapped after parsing without ever being length-checked. An attacker can exceed the configured array limit and force excessive memory allocation by supplying a query string or form body that uses the bracket-key comma form, for example a[]=1,2,3,.... This requires the application to parse untrusted input with the comma: true option enabled alongside a configured arrayLimit or throwOnLimitExceeded.
How to fix Allocation of Resources Without Limits or Throttling? Upgrade qs to version 6.16.0 or higher.
| |
