qs
6.17.1 · 28 Oct 2026BSD-3-Clause214.6M / weekRepositorynpmAtom feed
Your version
6.17.1 is the newest release of 6.x.
In short
1 fixed6 changed1 internal
Security
Fixes 1 advisory that affected 6.15.1
- Moderateqs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is setGHSA-q8mj-m7cp-5q26 · 22 May 2026Fixed in 6.15.2
3 advisories affect 6.15.2; 6.16.1 fixes them
- Moderateqs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)GHSA-6pq8-jhm2-2vcw · 27 Oct 2026Fixed in 6.16.1
- Moderateqs array-limit bypass via bracket-key comma parsingGHSA-x5fp-wj9c-mxmx · 2 Sep 2026Fixed in 6.16.0
- Moderateqs: Denial of Service via Attacker Controlled isBufferGHSA-4mjr-xmp4-gh2g · 2 Sep 2026Fixed in 6.16.0
Release note
stringify: skip null/undefined entries inarrayFormat: 'comma'+encodeValuesOnlyinstead of crashing inencoderstringify: use configureddelimiteraftercharsetSentinelstringify: applyformatterto encoded key understrictNullHandlingstringify: skip null/undefined filter-array entries instead of crashing inencoderparse: handle nested bracket groups and add regression tests (#530); changes output for some unbalanced bracket keys (see #558)Fix grammar
Update
@ljharb/eslint-config