Skip to main content
HIGH

CVE-2022-24999

CVSS v3

7.5

HIGH

EPSS Score

15.6 %

exploit probability, as of 2026-10-19

CISA KEV

No

known exploited

Exploitation

—

SSVC status

Get an alert for each new CVE published for express.

Set up CVE WatchFree account · no credit card

Affected and fixed versions

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Packages

  • qsnpmall versions · fixed in 6.2.4
  • nodejsAlmaLinux:8all versions · fixed in 1:14.21.1-2.module_el8.7.0+3373+a4c18c43and 3 other packages
  • nodejs-nodemonAlmaLinux:8all versions · fixed in 2.0.20-2.module_el8.7.0+3373+a4c18c43
  • nodejs-packagingAlmaLinux:8all versions · fixed in 23-3.module_el8.4.0+2522+3bd42762
  • npmAlmaLinux:8all versions · fixed in 1:6.14.17-1.14.21.1.2.module_el8.7.0+3373+a4c18c43

Vendor advisories

  • CVE-2022-24999 Red Hat Product Security134 products fixed · 60 known affected

    express: "qs" prototype poisoning causes the hang of the node process

    rh-dotnet31-aspnetcore-runtime-3.1 as a component of .NET Core 3.1 on Red Hat Enterprise Linux · rh-dotnet31-aspnetcore-targeting-pack-3.1 as a component of .NET Core 3.1 on Red Hat Enterprise Linux · rh-dotnet31-dotnet as a component of .NET Core 3.1 on Red Hat Enterprise Linux

  • ICSA-25-084-01 CISA2 products fixed · 2 known affected

    ABB RMC-100

    RMC-100 (2105457-036 to 2105457-044) · RMC-100 LITE (2106229-010 to 2106229-016)

  • RHSA-2023:3645 Red Hat Product Security3 products fixed

    Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.2.7 security update

  • RHSA-2023:3265 Red Hat Product Security3 products fixed

    Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.12.3 Security and Bug fix update

  • RHSA-2023:1742 Red Hat Product Security30 products fixed

    Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update

  • RHSA-2023:1533 Red Hat Product Security30 products fixed

    Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update

7 more advisories

Full record on NVD

Description

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).

Technical details

Published
2022-11-26

Frequently asked questions

What is CVE-2022-24999?

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).

Is CVE-2022-24999 actively exploited?

Active exploitation of CVE-2022-24999 has not been confirmed. Its EPSS score was 15.6% on 2026-10-19, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2022-24999?

CVE-2022-24999 has a CVSS v3 base score of 7.5 (HIGH severity).

Running express? Hear about its next vulnerability

CVE Watch matches each new CVE to the vendors and products you list (vendor and product, not the version) and puts it in your alerts with its KEV and EPSS status.

Get alerts for this productCISA KEV additions, October 2026Search CVEs

Already have an account? Open CVE WatchNo credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database