qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used.
### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion.
The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time.
CVSS 3.0HIGH 7.5·Network·No auth·No interaction·EPSS 0.01377·Published 2018-05-31·Fixed in 1.0.0CWE-400
THREATIST.IORead the docs