Denial of Service Vulnerability in Node.js qs Module

CVE-2014-7191

What is CVE-2014-7191?

The qs module in Node.js versions prior to 1.0.0 contains a vulnerability that allows remote attackers to exploit it through a crafted array. By providing a large index value, attackers can trigger memory exhaustion, resulting in denial of service. This occurs because the compact function is not invoked for array data, leading to the creation of a sparse array that consumes excessive memory resources.

References