qs

6.17.1 · 28 Oct 2026BSD-3-Clause214.6M / weekRepository npm Atom feed

Your version

6.4.0

6 Mar 2017Where it was published

6.17.1 is the newest release of 6.x.

In short

1 new5 changed1 internal

Security

3 advisories affect 6.4.0; 6.16.0 fixes them

High
qs vulnerable to Prototype PollutionGHSA-hrpp-h998-j3pp · 27 Nov 2022
Fixed in 6.10.3
Moderate
qs: Denial of Service via Attacker Controlled isBufferGHSA-4mjr-xmp4-gh2g · 2 Sep 2026
Fixed in 6.16.0
Moderate
qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustionGHSA-6rw7-vpxm-498p · 30 Dec 2025
Fixed in 6.14.1

Release note

qs.stringify: add encodeValuesOnly option
Follow allowPrototypes option during merge (#201, #201)
Support keys starting with brackets (#202, #200)
Chmod a-x
Update eslint
Reduce warnings