The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example, in a web application, other requests would not be processed while this blocking is occurring.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Qs | Qs_project | * | 1.0.0 (excluding) |
| Node-qs | Ubuntu | artful | * |
| Node-qs | Ubuntu | esm-infra-legacy/trusty | * |
| Node-qs | Ubuntu | trusty | * |
| Node-qs | Ubuntu | trusty/esm | * |
| Node-qs | Ubuntu | upstream | * |