qs
6.17.1 · 28 Oct 2026BSD-3-Clause214.6M / weekRepositorynpmAtom feed
6.17.1 is the newest release of 6.x.
In short
2 fixed8 changed1 internal
Security
Fixes 1 advisory that affected 6.14.1
- Lowqs's arrayLimit bypass in comma parsing allows denial of serviceGHSA-w7fw-mjwx-w883 · 12 Feb 2026Fixed in 6.14.2
4 advisories affect 6.14.2; 6.16.1 fixes them
- Moderateqs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)GHSA-6pq8-jhm2-2vcw · 27 Oct 2026Fixed in 6.16.1
- Moderateqs array-limit bypass via bracket-key comma parsingGHSA-x5fp-wj9c-mxmx · 2 Sep 2026Fixed in 6.16.0
- Moderateqs: Denial of Service via Attacker Controlled isBufferGHSA-4mjr-xmp4-gh2g · 2 Sep 2026Fixed in 6.16.0
- Moderateqs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is setGHSA-q8mj-m7cp-5q26 · 22 May 2026Fixed in 6.15.2
Release note
parse: mark overflow objects for indexed notation exceedingarrayLimitarrayLimitmeans max count, not max index, incombine/merge/parseArrayValueparse: throw onarrayLimitexceeded with indexed notation whenthrowOnLimitExceededis trueparse: enforcearrayLimitoncomma-parsed valuesparse: fix error message to reflect arrayLimit as max index; remove extraneous commentsAvoid
.push, usevoidDocument that
addQueryPrefixdoes not add?to empty outputClarify
parseArraysandarrayLimitdocumentationReplace runkit CI badge with shields.io check-runs badge
Fix rebase workflow permissions