qs
6.17.1 · 28 Oct 2026BSD-3-Clause214.6M / weekRepositorynpmAtom feed
6.17.1 is the newest release of 6.x.
In short
1 new1 fixed14 changed4 internal
Security
5 advisories affect 6.12.0; 6.16.1 fixes them
- Moderateqs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)GHSA-6pq8-jhm2-2vcw · 27 Oct 2026Fixed in 6.16.1
- Moderateqs: Denial of Service via Attacker Controlled isBufferGHSA-4mjr-xmp4-gh2g · 2 Sep 2026Fixed in 6.16.0
- Moderateqs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is setGHSA-q8mj-m7cp-5q26 · 22 May 2026Fixed in 6.15.2
- Moderateqs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustionGHSA-6rw7-vpxm-498p · 30 Dec 2025Fixed in 6.14.1
- Lowqs's arrayLimit bypass in comma parsing allows denial of serviceGHSA-w7fw-mjwx-w883 · 12 Feb 2026Fixed in 6.14.2
Release note
parse/stringify: adddecodeDotInKeys/encodeDotKeysoptionsparse: addduplicatesoptionparse/stringify: addallowEmptyArraysoption to allow in object valuesparse/stringify: move allowDots config logic to its own variablestringify: move option-handling code intonormalizeStringifyOptionsUpdate readme, add logos
stringify: clarify defaultarrayFormatbehaviorFix line wrapping
Remove dead badges
Update
side-channelMake the dist build 50% smaller
Add
sideEffectsflagRun build in prepack, not prepublish
Update
@ljharb/eslint-config,aud,has-override-mistake,has-property-descriptors,mock-property,npmignore,object-inspect,tapePin
glob, since v10.3.8+ requires a brokenjackspeakPin
jackspeaksince 2.1.2+ depends on npm aliases, which kill the install process in npm < 6