QS
Product
qs
5
CVEs
0
On KEV
5.3
Max CVSS
2
New 30D
Severity mix
Critical 0High 0Medium 3Low 2
Watch
Add qs to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-110816 | 5.3 | Oct 14 | qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a string Affected: 6.7.0 before 6.16.1 |
| CVE-2026-82417 | 5.3 | Aug 29 | qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property Affected: 2.2.5 before 6.16.0 |
| CVE-2026-8723 | 5.3 | May 16 | qs.stringify crashes on null/undefined entries in comma-format arrays under encodeValuesOnly Affected: 6.11.1 before 6.15.2 |
| CVE-2026-110910 New | 3.7 | Oct 27 | qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection Affected: 6.12.0 before 6.12.6; 6.13.0 before 6.13.4; 6.14.0 before 6.14.3; 6.15.0 before 6.15.4; 6.16.0 before 6.16.2 |
| CVE-2026-82562 | 3.7 | Aug 29 | qs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391) Affected: 6.14.2 before 6.16.0 |
Showing 5