{"action":"Upgrade qs to 6.2.4 or later.","affected":[{"fixed":"6.10.3","introduced":"6.10.0"},{"fixed":"6.9.7","introduced":"6.9.0"},{"fixed":"6.8.3","introduced":"6.8.0"},{"fixed":"6.7.3","introduced":"6.7.0"},{"fixed":"6.6.1","introduced":"6.6.0"},{"fixed":"6.5.3","introduced":"6.5.0"},{"fixed":"6.4.1","introduced":"6.4.0"},{"fixed":"6.3.3","introduced":"6.3.0"},{"fixed":"6.2.4","introduced":"0"}],"component":"qs","cve_ids":["CVE-2022-24999"],"ecosystem":"npm","epss":0.15622,"exploited":false,"fixed_versions":["6.10.3","6.9.7","6.8.3","6.7.3","6.6.1","6.5.3","6.4.1","6.3.3","6.2.4"],"ghsa_id":"GHSA-hrpp-h998-j3pp","id":"tcs_01M5KFW0B7BH61TCNB0T397TB2","modified_at":"2025-04-29T15:41:43Z","published_at":"2022-11-27T00:30:50Z","references":["https://osv.dev/vulnerability/GHSA-hrpp-h998-j3pp","https://nvd.nist.gov/vuln/detail/CVE-2022-24999","https://github.com/ljharb/qs/pull/428","https://github.com/ljharb/qs/commit/4310742efbd8c03f6495f07906b45213da0a32ec","https://github.com/ljharb/qs/commit/727ef5d34605108acb3513f72d5435972ed15b68","https://github.com/ljharb/qs/commit/73205259936317b40f447c5cdb71c5b341848e1b","https://github.com/ljharb/qs/commit/8b4cc14cda94a5c89341b77e5fe435ec6c41be2d","https://github.com/ljharb/qs/commit/ba24e74dd17931f825adb52f5633e48293b584e1","https://github.com/ljharb/qs/commit/e799ba57e573a30c14b67c1889c7c04d508b9105","https://github.com/ljharb/qs/commit/ed0f5dcbef4b168a8ae299d78b1e4a2e9b1baf1f","https://github.com/ljharb/qs/commit/f945393cfe442fe8c6e62b4156fd35452c0686ee","https://github.com/ljharb/qs/commit/fc3682776670524a42e19709ec4a8138d0d7afda","https://github.com/expressjs/express/releases/tag/4.17.3","https://github.com/ljharb/qs","https://github.com/n8tz/CVE-2022-24999","https://lists.debian.org/debian-lts-announce/2023/01/msg00039.html","https://security.netapp.com/advisory/ntap-20230908-0005"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-hrpp-h998-j3pp","url":"https://osv.dev/vulnerability/GHSA-hrpp-h998-j3pp"}],"summary":"qs vulnerable to Prototype Pollution"}