qs vulnerabilities (Root)

5 vulnerabilities.

• qs Root qs.stringify crashes on null/undefined entries in comma-format arrays under encodeValuesOnly CVE-2026-8723 Fix available 6.3 MediumMay 4, 2026
• qs Root qs's arrayLimit bypass in comma parsing allows denial of service CVE-2026-2391 Fix available 6.3 MediumFebruary 12, 2026
• qs Root arrayLimit bypass in bracket notation allows DoS via memory exhaustion CVE-2025-15284 Fix available 6.3 MediumDecember 29, 2025
• qs Root qs vulnerable to Prototype Pollution CVE-2022-24999 Public exploitFix available EPSS 15.7% 7.5 HighNovember 26, 2022
• qs Root Prototype Pollution Protection Bypass in qs CVE-2017-1000048 Fix available 7.5 HighJuly 13, 2017