qs
6.17.1 · 28 Oct 2026BSD-3-Clause214.6M / weekRepositorynpmAtom feed
6.17.1 is the newest release of 6.x.
In short
9 changed4 internal
Security
Fixes 2 advisories that affected 6.15.4
- Moderateqs array-limit bypass via bracket-key comma parsingGHSA-x5fp-wj9c-mxmx · 2 Sep 2026Fixed in 6.16.0
- Moderateqs: Denial of Service via Attacker Controlled isBufferGHSA-4mjr-xmp4-gh2g · 2 Sep 2026Fixed in 6.16.0
1 advisory affects 6.16.0; 6.16.1 fixes them
- Moderateqs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)GHSA-6pq8-jhm2-2vcw · 27 Oct 2026Fixed in 6.16.1
Release note
stringify: add adepthoption to bound recursion depth (defaultInfinity)stringify: Serialize Date values when a filter is provided
parse: enforcearrayLimiton comma groups under=whenthrowOnLimitExceededis setparse: flatten a collection appended to an overflowed arrayutils:isBuffer: do not invoke a non-callableconstructor.isBufferstringify: do not letallowEmptyArraysskip cycle detection (or drop own keys) on an empty array with own propertiesstringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is setUpdate
@ljharb/eslint-config,eslintUpdate
eslint,evalmd