qs
6.17.1 · 28 Oct 2026BSD-3-Clause214.6M / weekRepositorynpmAtom feed
Your version
6.17.1 is the newest release of 6.x.
In short
1 new2 fixed5 changed4 internal
Security
4 advisories affect 6.3.0; 6.16.0 fixes them
- Highqs vulnerable to Prototype PollutionGHSA-hrpp-h998-j3pp · 27 Nov 2022Fixed in 6.10.3
- HighPrototype Pollution Protection Bypass in qsGHSA-gqgv-6jq5-jjj9 · 30 Apr 2020Fixed in 6.3.2
- Moderateqs: Denial of Service via Attacker Controlled isBufferGHSA-4mjr-xmp4-gh2g · 2 Sep 2026Fixed in 6.16.0
- Moderateqs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustionGHSA-6rw7-vpxm-498p · 30 Dec 2025Fixed in 6.14.1
Release note
stringify: AddserializeDateoption to customize Date serializationEnsure
utils.mergehandles merging two arraysOnly constructors should be capitalized
Capitalized var names are for constructors only
Avoid using a sparse array
formats: cacheString#replaceUpdate
browserify,eslint,@ljharb/eslint-config; addsafe-publish-latest