qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Information Disclosure
Prototype Pollution
Qs
Express
Debian Linux
NVD
GitHub
CVSS 3.1
7.5
EPSS
14.7%