QS
Product
qs
5
CVEs
0
On KEV
5.3
Max CVSS
2
New 30D
Severity mix
Critical 0High 0Medium 3Low 2
Watch
Add qs to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-110910 New | 3.7 | Oct 27 | qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection Affected: 6.12.0 before 6.12.6; 6.13.0 before 6.13.4; 6.14.0 before 6.14.3; 6.15.0 before 6.15.4; 6.16.0 before 6.16.2 |
| CVE-2026-82562 | 3.7 | Aug 29 | qs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391) Affected: 6.14.2 before 6.16.0 |
Showing 2