CVE-2022-24999 in qs
Summary
by MITRE • 11/27/2022
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 01/20/2026
The vulnerability CVE-2022-24999 represents a critical prototype pollution flaw affecting the qs library version 6.10.2 and earlier, which is widely utilized in Express.js applications and other Node.js environments. This vulnerability stems from improper handling of query string parameters containing prototype pollution vectors, specifically leveraging the _proto_ key that allows attackers to manipulate the prototype chain of objects within Node.js applications. The flaw exists because the qs library fails to properly sanitize input when parsing query strings, enabling malicious actors to inject prototype pollution payloads that can fundamentally alter the behavior of JavaScript objects.
The technical exploitation of this vulnerability occurs when an attacker crafts a malicious query string containing the _proto_ key with specific values that can cause Node.js processes to hang or behave unpredictably. A typical attack payload might appear as a[_proto_]=b&a[_proto_]&a[length]=100000000 where the _proto_ key is used to pollute the Object prototype, potentially leading to denial of service conditions or more severe consequences depending on the application's context. This vulnerability is particularly dangerous because it can be triggered through simple HTTP GET requests without requiring authentication, making it an attractive target for remote attackers. The vulnerability is classified under CWE-471 as "Modification of Externally-Controllable Parameters" and falls under the ATT&CK technique T1211 for "Exploitation for Defense Evasion" when used to manipulate application behavior.
The operational impact of this vulnerability extends beyond simple denial of service scenarios, as prototype pollution can lead to more severe consequences including arbitrary code execution, data manipulation, and application instability. When an Express application processes a malicious query string containing the _proto_ key, the Node.js process may become unresponsive or consume excessive memory resources, effectively creating a denial of service condition that can impact legitimate users. The vulnerability affects a wide range of applications since qs is a fundamental dependency in many Node.js frameworks and middleware components. The fix implemented in qs versions 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 addresses the core parsing issue by properly sanitizing prototype-related keys during query string processing, preventing attackers from manipulating object prototypes through malicious input.
Organizations should prioritize updating their Express applications to version 4.17.3 or later, which includes the patched qs dependency, and ensure all related components are updated to prevent exploitation. System administrators should implement input validation at the application level and consider deploying web application firewalls to detect and block suspicious query string patterns. The vulnerability highlights the importance of proper input sanitization and the need for security-conscious development practices when handling user-provided data in web applications. Regular security audits and dependency updates should be implemented as part of the security posture to prevent similar vulnerabilities from being exploited in the future. This vulnerability demonstrates how seemingly minor parsing issues in widely-used libraries can create significant security risks across the entire Node.js ecosystem, emphasizing the critical nature of maintaining up-to-date dependencies and proper security hygiene in modern web applications.