qs
6.17.1 · 28 Oct 2026BSD-3-Clause214.6M / weekRepositorynpmAtom feed
6.17.1 is the newest release of 6.x.
In short
2 new11 changed1 internal
Security
3 advisories affect 6.6.0; 6.16.0 fixes them
- Highqs vulnerable to Prototype PollutionGHSA-hrpp-h998-j3pp · 27 Nov 2022Fixed in 6.10.3
- Moderateqs: Denial of Service via Attacker Controlled isBufferGHSA-4mjr-xmp4-gh2g · 2 Sep 2026Fixed in 6.16.0
- Moderateqs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustionGHSA-6rw7-vpxm-498p · 30 Dec 2025Fixed in 6.14.1
Release note
Add support for iso-8859-1, utf8 "sentinel" and numeric entities
Move two-value combine to a
utilsfunctionstringify: fix a crash withstrictNullHandlingand a customfilter/serializeDateWhen
parseArraysis false, properly handle keys ending in ``stringify: do not crash in an obscure combo ofinterpretNumericEntities, a bad customdecoder, &iso-8859-1utils:merge: fix crash whensourceis a truthy primitive & no options are providedstringify: Avoid arr = arr.concat(...), push to the existing instanceparse: only need to reassign the var onceparse/stringify: clean upcharsetoptions checking; fix defaultsAdd missing defaults
parse: one lessconcatcallutils:compactQueue: make it explicitly side-effectingUpdate
browserify,eslint,@ljharb/eslint-config,iconv-lite,safe-publish-latest,tape