Homepage

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') The advisory has been revoked - it doesn't affect any version of package qs.src  (opens in a new tab)

Threat Intelligence

EPSS
1.14% (79th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-QSSRC-14923084
  • published14 Jan 2026
  • disclosed26 Nov 2022
Report a new vulnerability Found a mistake?

Introduced: 26 Nov 2022

CVE-2022-24999  (opens in a new tab)
CWE-1321  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream qs.src package and not the qs.src package as distributed by RHEL.

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).