1. Home
  2. CVE Database
  3. CVE-2014-10064
HIGH · 7.5

CVE-2014-10064

The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of ti...

Vulnerability Description

The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example, in a web application, other requests would not be processed while this blocking is occurring.

CVSS Score

7.5

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH

Affected Products

VendorProductVersions
Qs ProjectQs< 1.0.0

Related Weaknesses (CWE)

CWE-400CWE-399

References

FAQ

What is CVE-2014-10064?

CVE-2014-10064 is a vulnerability with a CVSS score of 7.5 (HIGH). The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of ti...

How severe is CVE-2014-10064?

CVE-2014-10064 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2014-10064?

Check the references section above for vendor advisories and patch information. Affected products include: Qs Project Qs.