High severity · published Jul 17, 2017
CVE-2017-1000048
the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS
7.5
CVSS
2.4%
EPSS
No
On KEV
Description
the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QS
QS · QS Project
1.0.0; 1.0.1; 1.0.2; 1.1.0; 1.2.0; 1.2.1; +24 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-1000048
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-1000048
access.redhat.com
https://access.redhat.com/errata/RHSA-2017:2672
Third Party Advisory
https://github.com/ljharb/qs/issues/200
More from QS
7.5
CVE-2026-2391
qs's arrayLimit bypass in comma parsing allows denial of service
7.5
CVE-2022-24999
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be…
7.5
CVE-2014-10064
The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop…
3.7
CVE-2025-15284
arrayLimit bypass in bracket notation allows DoS via memory exhaustion