What’s Vulnerable › Vulnerabilities

CVE-2017-1000048: Prototype Pollution Protection Bypass in qs

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-07-17 · updated 2026-06-17
• Weakness: CWE-20

Description

the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.

Affected products

• HackerOne qs node module: 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.2.0, 1.2.1 (+24)
• Npm Qs: before 6.0.4; from 6.1.0 before 6.1.2; from 6.2.0 before 6.2.3; from 6.3.0 before 6.3.2 — fixed in 6.0.4, 6.1.2, 6.2.3, 6.3.2

How to fix

Upgrade to a fixed version: Npm Qs 6.0.4, 6.1.2, 6.2.3, 6.3.2. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2017:2672
• https://github.com/ljharb/qs/issues/200
• https://access.redhat.com/errata/RHSA-2017:2672
• https://github.com/ljharb/qs/issues/200

Get alerted when CVE-2017-1000048 or the next vulnerability affects your stack