qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Information Disclosure
Debian
Express
Prototype Pollution
Debian Linux
+3
NVD
GitHub
CVSS 3.1
7.5
EPSS
14.7%