node-qs vulnerabilities (Ubuntu)

9 vulnerabilities.

• node-qs Ubuntu qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a string CVE-2026-110816 Fix available 6.3 MediumOctober 14, 2026
• node-qs Ubuntu qs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391) CVE-2026-82562 Fix available 6.3 MediumAugust 29, 2026
• node-qs Ubuntu qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property CVE-2026-82417 Fix available 6.3 MediumAugust 29, 2026
• node-qs Ubuntu qs.stringify crashes on null/undefined entries in comma-format arrays under encodeValuesOnly CVE-2026-8723 Fix available 6.3 MediumMay 4, 2026
• node-qs Ubuntu qs's arrayLimit bypass in comma parsing allows denial of service CVE-2026-2391 Fix available 6.3 MediumFebruary 12, 2026
• node-qs Ubuntu arrayLimit bypass in bracket notation allows DoS via memory exhaustion CVE-2025-15284 Fix available 6.3 MediumDecember 29, 2025
• node-qs Ubuntu qs vulnerable to Prototype Pollution CVE-2022-24999 Public exploitFix available EPSS 15.7% 7.5 HighNovember 26, 2022
• node-qs Ubuntu Denial-of-Service Extended Event Loop Blocking in qs CVE-2014-10064 Fix available 7.5 HighMay 31, 2018
• node-qs Ubuntu Denial-of-Service Memory Exhaustion in qs CVE-2014-7191 Fix available 5.0 MediumOctober 19, 2014