CVE-2014-10064

Vulnerability

The qs module (a query string parser for Node.js) before version 1.0.0 did not impose a limit on the depth of nested objects when parsing a query string. This lack of a configurable or default maximum depth allowed an attacker to craft a specially formatted query string representing an extremely deeply nested object. The parsing of such input would consume significant processing time, blocking the Node.js event loop. All versions prior to 1.0.0 are affected [1][2].

Exploitation

An attacker can exploit this vulnerability by sending a single HTTP request containing a query string with deeply nested parameters (e.g., a[b][c][d]...[z] with many levels). No authentication or special privileges are required. The attacker only needs the ability to make a request to a web application that uses the vulnerable qs module to parse query strings. The malicious request is processed normally by the server; the event-loop blocking occurs during the parsing step [1].

Impact

Successful exploitation causes a temporary Denial-of-Service (DoS). While the vulnerable qs module is processing the deeply nested object, the Node.js event loop is blocked, preventing the server from handling any other requests. This leads to service unavailability for legitimate users for the duration of the blocking period [1].

Mitigation

Upgrade the qs module to version 1.0.0 or later. Version 1.0.0 introduced a default depth limit and an option to configure the maximum depth, which prevents event-loop blocking from deeply nested objects [1][2]. No workaround is available for earlier versions other than upgrading. This CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.