Denial-of-Service Memory Exhaustion in qs (GHSA-jjv7-qpx3-h62q)
Published: 2017-10-24T18:33:36Z
Aliases: CVE-2014-7191
Severity: HIGH · CWE: CWE-400

Versions prior to 1.0 of `qs` are affected by a denial of service condition. This condition is triggered by parsing a crafted string that deserializes into very large sparse arrays, resulting in the process running out of memory and eventually crashing.


## Recommendation

Update to version 1.0.0 or later.

Affected packages:
package: ecosystem: npm
name: qs
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.0.0