qs vulnerabilities (npm)
10 vulnerabilities.
-
qsnpm qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a string 6.3 Medium -
qsnpm qs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391) 6.3 Medium -
qsnpm qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property 6.3 Medium -
qsnpm qs.stringify crashes on null/undefined entries in comma-format arrays under encodeValuesOnly 6.3 Medium -
qsnpm qs's arrayLimit bypass in comma parsing allows denial of service 6.3 Medium -
qsnpm arrayLimit bypass in bracket notation allows DoS via memory exhaustion 6.3 Medium -
qsnpm qs vulnerable to Prototype Pollution 7.5 High -
qsnpm Denial-of-Service Extended Event Loop Blocking in qs 7.5 High -
qsnpm Prototype Pollution Protection Bypass in qs 7.5 High -
qsnpm Denial-of-Service Memory Exhaustion in qs 5.0 Medium