qs
6.17.1 · 28 Oct 2026BSD-3-Clause214.6M / weekRepositorynpmAtom feed
Your version
6.17.1 is the newest release of 6.x.
In short
8 changed1 internal
Security
3 advisories affect 6.15.3; 6.16.1 fixes them
- Moderateqs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)GHSA-6pq8-jhm2-2vcw · 27 Oct 2026Fixed in 6.16.1
- Moderateqs array-limit bypass via bracket-key comma parsingGHSA-x5fp-wj9c-mxmx · 2 Sep 2026Fixed in 6.16.0
- Moderateqs: Denial of Service via Attacker Controlled isBufferGHSA-4mjr-xmp4-gh2g · 2 Sep 2026Fixed in 6.16.0
Release note
parse: enforcethrowOnLimitExceededfor cumulative array growth viacombine/mergeutils: respect encoding of surrogate pairs across chunksparse: throw thearrayLimiterror before splitting oversized comma valuesutils.merge/utils.assign: avoid invoking__proto__setter when copying own propertiesutils: enforcearrayLimitconsistently acrossmerge's array pathsutils: makecompactO(n) via a side-channel visited-set instead ofArray.indexOfUpdate
side-channelUpdate
eslint,mock-property,tape