qs
6.17.1 · 28 Oct 2026BSD-3-Clause214.6M / weekRepositorynpmAtom feed
Your version
6.17.1 is the newest release of 6.x.
In short
3 new2 fixed4 changed3 internal
Security
5 advisories affect 6.8.0; 6.16.1 fixes them
- Highqs vulnerable to Prototype PollutionGHSA-hrpp-h998-j3pp · 27 Nov 2022Fixed in 6.10.3
- Moderateqs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)GHSA-6pq8-jhm2-2vcw · 27 Oct 2026Fixed in 6.16.1
- Moderateqs: Denial of Service via Attacker Controlled isBufferGHSA-4mjr-xmp4-gh2g · 2 Sep 2026Fixed in 6.16.0
- Moderateqs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustionGHSA-6rw7-vpxm-498p · 30 Dec 2025Fixed in 6.14.1
- Lowqs's arrayLimit bypass in comma parsing allows denial of serviceGHSA-w7fw-mjwx-w883 · 12 Feb 2026Fixed in 6.14.2
Release note
Add
depth=falseto preserve the original key; [Fix]depth=0should preserve the original keyStringify symbols and bigints
Ensure node 0.12 can stringify Symbols
Fix for an impossible situation: when the formatter is called with a non-string value
formats: tiny bit of cleanup.Update
eslint,@ljharb/eslint-config,browserify,safe-publish-latest,iconv-lite,tapeAdd github sponsorship
Add FUNDING.yml
Clean up license text so it’s properly detected as BSD-3-Clause