qs
6.17.1 · 28 Oct 2026BSD-3-Clause214.6M / weekRepositorynpmAtom feed
Your version
6.5.4
12 Feb 20266.17.1 is the newest release of 6.x.
npm marks 6.5.4 as deprecated: This version has regressions from a robustness refactor: parse incorrectly handles keys exceeding the depth option, and stringify incorrectly percent-encodes low-byte characters. Upgrade to 6.5.5.
Security
2 advisories affect 6.5.4; 6.16.0 fixes them
- Moderateqs: Denial of Service via Attacker Controlled isBufferGHSA-4mjr-xmp4-gh2g · 2 Sep 2026Fixed in 6.16.0
- Moderateqs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustionGHSA-6rw7-vpxm-498p · 30 Dec 2025Fixed in 6.14.1
Release note
No note was found for 6.5.4 on GitHub or in the repository's changelog.