CVE-2014-7191 Denial-of-Service Memory Exhaustion in qs
Remote attackers can cause denial of service via memory consumption in the Node.js qs module by exploiting sparse array creation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-7191?
CVE-2014-7191 is a medium-severity denial of service vulnerability in Nodejs Node.js, published on 19 Oct 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.
Weakness: CWE-399
Which versions are affected by CVE-2014-7191?
2 open source packages ship an affected version, including qs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
qs npm | All versions | 1.0.0 |
qs npm | All versions | 1.0.0 |
Linux distribution packages (4)
nodejs010-node-gyp Red Hat:rhel_software_collections:2::el6 | All versions | 0:3.2.0-3.el6 |
nodejs010-nodejs-qs Red Hat:rhel_software_collections:2::el6 | All versions | 0:0.6.5-5.el6 |
nodejs010-node-gyp Red Hat:rhel_software_collections:2::el7 | All versions | 0:3.2.0-3.el7 |
nodejs010-nodejs-qs Red Hat:rhel_software_collections:2::el7 | All versions | 0:0.6.5-5.el7 |
Products include Nodejs Node.js.
How do I fix CVE-2014-7191?
Upgrade qs to 1.0.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2014-7191 being exploited?
There is no known exploitation of CVE-2014-7191 in the wild and no public exploit code.
Other vulnerabilities in Nodejs Node.js
Sources
Also known as DEBIAN-CVE-2014-7191, GHSA-jjv7-qpx3-h62q, RHSA-2016:1380, UBUNTU-CVE-2014-7191.