CVE-2014-7191

Published: Oct 19, 2014Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.

Affected (1)

Products: Nodejs: Node.js

Nodejs

1 product

Node.js

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Nodejs Node.js	Up to 0.10.18

Related CWEs

CWE-399

References (20)

http://secunia.com/advisories/60026

Source: cve@mitre.org

http://secunia.com/advisories/62170

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=swg21685987

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=swg21687263

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=swg21687928

Source: cve@mitre.org

https://access.redhat.com/errata/RHSA-2016:1380

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/96729

Source: cve@mitre.org

https://github.com/raymondfeng/node-querystring/commit/43a604b7847e56bba49d0ce3e222fe89569354d8

Source: cve@mitre.org

Patch

https://github.com/visionmedia/node-querystring/issues/104

Source: cve@mitre.org

https://nodesecurity.io/advisories/qs_dos_memory_exhaustion

Source: cve@mitre.org

http://secunia.com/advisories/60026