Read the docs
TI-2022-08786 Aliases CVE-2022-24999GHSA-hrpp-h998-j3pp

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers…

Priority HIGH 72CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 11 fixed, 26 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.

Summary

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.15695 96th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial qs (npm): 6.10.3, 6.9.7, 6.8.3 +6Red Hat: 11 advisoriesRed Hat: 11 fixed, 26 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—qs (npm)6.10.0 to before 6.10.36.10.3Patch availableGHSA-hrpp-h998-j3pp
—qs (npm)6.9.0 to before 6.9.76.9.7Patch availableGHSA-hrpp-h998-j3pp
—qs (npm)6.8.0 to before 6.8.36.8.3Patch availableGHSA-hrpp-h998-j3pp
—qs (npm)6.7.0 to before 6.7.36.7.3Patch availableGHSA-hrpp-h998-j3pp
—qs (npm)6.6.0 to before 6.6.16.6.1Patch availableGHSA-hrpp-h998-j3pp
—qs (npm)6.5.0 to before 6.5.36.5.3Patch availableGHSA-hrpp-h998-j3pp
—qs (npm)6.4.0 to before 6.4.16.4.1Patch availableGHSA-hrpp-h998-j3pp
—qs (npm)6.3.0 to before 6.3.36.3.3Patch availableGHSA-hrpp-h998-j3pp
—qs (npm)before 6.2.46.2.4Patch availableGHSA-hrpp-h998-j3pp
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • qs (npm) Vendor— Affected 6.10.0 to before 6.10.3 Fixed in 6.10.3 Patch available GHSA-hrpp-h998-j3pp
  • qs (npm) Vendor— Affected 6.9.0 to before 6.9.7 Fixed in 6.9.7 Patch available GHSA-hrpp-h998-j3pp
  • qs (npm) Vendor— Affected 6.8.0 to before 6.8.3 Fixed in 6.8.3 Patch available GHSA-hrpp-h998-j3pp
  • qs (npm) Vendor— Affected 6.7.0 to before 6.7.3 Fixed in 6.7.3 Patch available GHSA-hrpp-h998-j3pp
  • qs (npm) Vendor— Affected 6.6.0 to before 6.6.1 Fixed in 6.6.1 Patch available GHSA-hrpp-h998-j3pp
  • qs (npm) Vendor— Affected 6.5.0 to before 6.5.3 Fixed in 6.5.3 Patch available GHSA-hrpp-h998-j3pp
  • qs (npm) Vendor— Affected 6.4.0 to before 6.4.1 Fixed in 6.4.1 Patch available GHSA-hrpp-h998-j3pp
  • qs (npm) Vendor— Affected 6.3.0 to before 6.3.3 Fixed in 6.3.3 Patch available GHSA-hrpp-h998-j3pp
  • qs (npm) Vendor— Affected before 6.2.4 Fixed in 6.2.4 Patch available GHSA-hrpp-h998-j3pp

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:qs_project:qs:*:*:*:*:*:node.js:*:*before 6.2.4; 6.3.0 to before 6.3.3; 6.5.0 to before 6.5.3; 6.7.0 to before 6.7.3; 6.8.0 to before 6.8.3; 6.9.0 to before 6.9.7; 6.10.0 to before 6.10.3VulnerableQs Project
cpe:2.3:a:qs_project:qs:6.4.0:*:*:*:*:node.js:*:*6.4.0VulnerableQs Project
cpe:2.3:a:qs_project:qs:6.6.0:*:*:*:*:node.js:*:*6.6.0VulnerableQs Project
cpe:2.3:a:openjsf:express:*:*:*:*:*:node.js:*:*before 4.17.3Vulnerablefast-uri
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:qs_project:qs:*:*:*:*:*:node.js:*:* Versions before 6.2.4; 6.3.0 to before 6.3.3; 6.5.0 to before 6.5.3; 6.7.0 to before 6.7.3; 6.8.0 to before 6.8.3; 6.9.0 to before 6.9.7; 6.10.0 to before 6.10.3 Vulnerable ·Qs Project
  • cpe:2.3:a:qs_project:qs:6.4.0:*:*:*:*:node.js:*:* Versions 6.4.0 Vulnerable ·Qs Project
  • cpe:2.3:a:qs_project:qs:6.6.0:*:*:*:*:node.js:*:* Versions 6.6.0 Vulnerable ·Qs Project
  • cpe:2.3:a:openjsf:express:*:*:*:*:*:node.js:*:* Versions before 4.17.3 Vulnerable ·fast-uri
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-hrpp-h998-j3pp qs (npm) Fixed in 6.10.3 Advisory →
  • Fix · GHSA-hrpp-h998-j3pp qs (npm) Fixed in 6.9.7 Advisory →
  • Fix · GHSA-hrpp-h998-j3pp qs (npm) Fixed in 6.8.3 Advisory →
  • Fix · GHSA-hrpp-h998-j3pp qs (npm) Fixed in 6.7.3 Advisory →
  • Fix · GHSA-hrpp-h998-j3pp qs (npm) Fixed in 6.6.1 Advisory →
  • Fix · GHSA-hrpp-h998-j3pp qs (npm) Fixed in 6.5.3 Advisory →
  • Fix · GHSA-hrpp-h998-j3pp qs (npm) Fixed in 6.4.1 Advisory →
  • Fix · GHSA-hrpp-h998-j3pp qs (npm) Fixed in 6.3.3 Advisory →
  • Fix · GHSA-hrpp-h998-j3pp qs (npm) Fixed in 6.2.4 Advisory →

Red Hat 11 advisories

  • RHSA-2023:3645 Released 2023-06-15 · Red Hat rating Moderate
    Red Hat OpenShift Service Mesh 2.2.7 security update
    • RHOSSM 2.2 for RHEL 8 openshift-service-mesh/prometheus-rhel8
  • RHSA-2023:3265 Released 2023-05-23 · Red Hat rating Moderate
    Red Hat OpenShift Data Foundation 4.12.3 Security and Bug fix update
    • RHODF 4.12 for RHEL 8 odf4/mcg-core-rhel8
  • RHSA-2023:1742 Released 2023-04-12 · Red Hat rating Important
    nodejs:14 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64::nodejs:14, nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le::nodejs:14, nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x::nodejs:14 +19
Show 8 more Red Hat advisories
  • RHSA-2023:1533 Released 2023-03-30 · Red Hat rating Important
    nodejs:14 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v.8.4) nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64::nodejs:14, nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le::nodejs:14, nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x::nodejs:14 +19
  • RHSA-2023:1428 Released 2023-03-23 · Red Hat rating Important
    Migration Toolkit for Containers (MTC) 1.7.8 security and bug fix update
    • 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-ui-rhel8
  • RHSA-2023:0930 Released 2023-03-08 · Red Hat rating Moderate
    Logging Subsystem 5.5.8 - Red Hat OpenShift
    • RHOL 5.5 for RHEL 8 openshift-logging/elasticsearch-rhel8-operator, openshift-logging/eventrouter-rhel8, openshift-logging/logging-loki-rhel8 +1
  • RHSA-2023:0932 Released 2023-03-08 · Red Hat rating Moderate
    Logging Subsystem 5.6.3 - Red Hat OpenShift
    • RHOL 5.6 for RHEL 8 openshift-logging/cluster-logging-rhel8-operator, openshift-logging/eventrouter-rhel8, openshift-logging/logging-view-plugin-rhel8
  • RHSA-2023:0934 Released 2023-02-28 · Red Hat rating Important
    Migration Toolkit for Applications security and bug fix update
    • MTA 6.0 for RHEL 8 mta/mta-admin-addon-rhel8, mta/mta-hub-rhel8, mta/mta-ui-rhel8 +1
  • RHSA-2023:0794 Released 2023-02-15 · Red Hat rating Moderate
    Red Hat Advanced Cluster Management 2.6.4 bug fixes and security updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/acm-governance-policy-addon-controller-rhel8, rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8 +45
  • RHSA-2023:0612 Released 2023-02-06 · Red Hat rating Moderate
    rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update
    • Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs14-nodejs-14.21.1-3.el7, rh-nodejs14-nodejs-devel-14.21.1-3.el7, rh-nodejs14-nodejs-docs-14.21.1-3.el7 +3
    • Red Hat Software Collections for RHEL(v. 7) rh-nodejs14-nodejs-14.21.1-3.el7, rh-nodejs14-nodejs-devel-14.21.1-3.el7, rh-nodejs14-nodejs-docs-14.21.1-3.el7 +3
  • RHSA-2023:0050 Released 2023-01-09 · Red Hat rating Moderate
    nodejs:14 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64::nodejs:14, nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le::nodejs:14, nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x::nodejs:14 +19

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
.NET Core 3.1 on Red Hat Enterprise LinuxAffectedNo fix planned: Out of support scope
Migration Toolkit for VirtualizationAffectedNo fix yet: Fix deferred
OpenShift Service Mesh 2AffectedNo fix planned: Will not fix
OpenShift Service Mesh 2.1AffectedNo fix planned: Will not fix
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Advanced Cluster Security 3AffectedNo fix yet
Red Hat Ansible Automation Platform 1.2AffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix planned: Will not fix
Red Hat Ceph Storage 4AffectedNo fix planned: Will not fix
Red Hat Decision Manager 7AffectedNo fix planned: Out of support scope
Red Hat Directory Server 11AffectedNo fix planned: Will not fix
Red Hat Discovery 1AffectedNo fix yet
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat Integration Camel K 1AffectedNo fix yet
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat Openshift Container Storage 4AffectedNo fix planned: Out of support scope
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Process Automation 7AffectedNo fix planned: Out of support scope
Red Hat Quay 3AffectedNo fix planned: Will not fix
Red Hat Satellite 6AffectedNo fix planned: Will not fix
Red Hat build of Apicurio Registry 2AffectedNo fix yet
8Base-RHMTC-1.7Fixed RHSA-2023:1428
MTA 6.0 for RHEL 8Fixed RHSA-2023:0934
RHODF 4.12 for RHEL 8Fixed RHSA-2023:3265
RHOL 5.5 for RHEL 8Fixed RHSA-2023:0930
RHOL 5.6 for RHEL 8Fixed RHSA-2023:0932
RHOSSM 2.2 for RHEL 8Fixed RHSA-2023:3645
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2023:0050
Red Hat Enterprise Linux AppStream EUS (v.8.4)Fixed RHSA-2023:1533
Red Hat Enterprise Linux AppStream EUS (v.8.6)Fixed RHSA-2023:1742
Red Hat Software Collections for RHEL Workstation(v. 7)Fixed RHSA-2023:0612
Red Hat Software Collections for RHEL(v. 7)Fixed RHSA-2023:0612
Not affected: 10 products
  • 8Base-RHMTC-1.7
  • MTA 6.0 for RHEL 8
  • OpenShift Developer Tools and Services
  • RHODF 4.12 for RHEL 8
  • RHOL 5.5 for RHEL 8
  • RHOL 5.6 for RHEL 8
  • RHOSSM 2.2 for RHEL 8
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss Enterprise Application Platform 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-24999
  2. 2026-10-03 Alias added: GHSA-hrpp-h998-j3pp

References

Exploit 1

Patch 1

Advisory 2

Other 13

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences