CVE-2022-24999
1 advisory.
npm/qs CVE-2022-24999: high 7.5, EPSS 15.62%
qs vulnerable to Prototype Pollution
Action: Upgrade qs to 6.2.4 or later.
npm i qs@6.10.3npm i qs@6.9.7npm i qs@6.8.3npm i qs@6.7.3npm i qs@6.6.1npm i qs@6.5.3npm i qs@6.4.1npm i qs@6.3.3npm i qs@6.2.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.10.0 | 6.10.3 | - |
| 6.9.0 | 6.9.7 | - |
| 6.8.0 | 6.8.3 | - |
| 6.7.0 | 6.7.3 | - |
| 6.6.0 | 6.6.1 | - |
| 6.5.0 | 6.5.3 | - |
| 6.4.0 | 6.4.1 | - |
| 6.3.0 | 6.3.3 | - |
| 0 | 6.2.4 | - |
Fixed versions
| 6.10.3 | 6.9.7 | 6.8.3 | 6.7.3 | 6.6.1 | 6.5.3 | 6.4.1 | 6.3.3 | 6.2.4 |
Sources
- osv: GHSA-hrpp-h998-j3pp
- https://nvd.nist.gov/vuln/detail/CVE-2022-24999
- https://github.com/ljharb/qs/pull/428
- https://github.com/ljharb/qs/commit/4310742efbd8c03f6495f07906b45213da0a32ec
- https://github.com/ljharb/qs/commit/727ef5d34605108acb3513f72d5435972ed15b68
- https://github.com/ljharb/qs/commit/73205259936317b40f447c5cdb71c5b341848e1b
- https://github.com/ljharb/qs/commit/8b4cc14cda94a5c89341b77e5fe435ec6c41be2d
- https://github.com/ljharb/qs/commit/ba24e74dd17931f825adb52f5633e48293b584e1
- https://github.com/ljharb/qs/commit/e799ba57e573a30c14b67c1889c7c04d508b9105
- https://github.com/ljharb/qs/commit/ed0f5dcbef4b168a8ae299d78b1e4a2e9b1baf1f
- https://github.com/ljharb/qs/commit/f945393cfe442fe8c6e62b4156fd35452c0686ee
- https://github.com/ljharb/qs/commit/fc3682776670524a42e19709ec4a8138d0d7afda
- https://github.com/expressjs/express/releases/tag/4.17.3
- https://github.com/ljharb/qs
- https://github.com/n8tz/CVE-2022-24999
- https://lists.debian.org/debian-lts-announce/2023/01/msg00039.html
- https://security.netapp.com/advisory/ntap-20230908-0005
CVE-2022-24999 · published · modified · JSON