qs
6.17.1 · 28 Oct 2026BSD-3-Clause214.6M / weekRepositorynpmAtom feed
6.17.1 is the newest release of 6.x.
In short
1 fixed15 changed6 internal
Security
Fixes 1 advisory that affected 6.16.0
- Moderateqs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)GHSA-6pq8-jhm2-2vcw · 27 Oct 2026Fixed in 6.16.1
Release note
parse: do not mutate an object inputstringify: stop re-encoding structural separator dots whenencodeDotInKeysis setstringify:arrayFormat: 'comma': pass the full encoder arguments withencodeValuesOnlyutils: encode+as%2Bin iso-8859-1 mode so values round-tripparse: Only convert top-level dots to brackets when allowDots is on
stringify: ignore inherited array format namesstringify:arrayFormat: 'comma': do not throw on elements with no callabletoStringutils:merge: seed an overflow container's index from its own keys, not just the sourceutils:merge: keep astrictMergeconflict container's index andarrayLimitcorrectparse: only treat `` as array syntax when it ends the keydecode: skip decoders when there is no percent signutils:merge: applyarrayLimitto the two-element array built for colliding valuesparse: bound the nesting added by repeatedstrictMergeconflicts (credit @Yeaseen)Fix changelog indents
Set least-privilege
cache-modeUpdate
@ljharb/eslint-config,eslint,tape