Skip to content
Ljharb vulnerabilities
Newest
-
ljharb qs
qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection
CVE-2026-110910
Fix available
6.3 Medium
-
ljharb qs
qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a string
CVE-2026-110816
Fix available
6.3 Medium
-
ljharb traverse
traverse: set() can write to built-in prototypes via an untrusted path
CVE-2026-107353
Fix available
6.9 Medium
-
ljharb qs
qs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391)
CVE-2026-82562
Fix available
6.3 Medium
-
ljharb qs
qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property
CVE-2026-82417
Fix available
6.3 Medium
-
ljharb shell-quote
shell-quote parse() is quadratic in token count, enabling denial of service
CVE-2026-13311
Fix available
8.7 High
-
ljharb qs
qs.stringify crashes on null/undefined entries in comma-format arrays under encodeValuesOnly
CVE-2026-8723
Fix available
6.3 Medium
-
ljharb ljharb/npm-lockfile, npm-lockfile project npm-lockfile +1 more
OS Command Injection in ljharb/npm-lockfile
CVE-2022-0841
Fix available
3.8 Low