qs
6.17.1 · 28 Oct 2026BSD-3-Clause214.6M / weekRepositorynpmAtom feed
Your version
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
| Line | Newest | Where it stands |
|---|---|---|
| 6.17.1 | Safe from 6.16.1 | |
| 5.2.1 | 54 open advisories, worst high · last release Jul 2016, no longer updated |
- Highqs vulnerable to Prototype PollutionGHSA-hrpp-h998-j3pp · 27 Nov 2022fixed in 6.10.3
- HighPrototype Pollution Protection Bypass in qsGHSA-gqgv-6jq5-jjj9 · 30 Apr 2020fixed in 6.3.2
- HighDenial-of-Service Extended Event Loop Blocking in qsGHSA-f9cm-p3w6-xvr3 · 9 Oct 2018
- HighDenial-of-Service Memory Exhaustion in qsGHSA-jjv7-qpx3-h62q · 24 Oct 2017
- Moderateqs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)GHSA-6pq8-jhm2-2vcw · 27 Oct 2026fixed in 6.16.1
- Moderateqs array-limit bypass via bracket-key comma parsingGHSA-x5fp-wj9c-mxmx · 2 Sep 2026fixed in 6.16.0
- Moderateqs: Denial of Service via Attacker Controlled isBufferGHSA-4mjr-xmp4-gh2g · 2 Sep 2026fixed in 6.16.0
- Moderateqs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is setGHSA-q8mj-m7cp-5q26 · 22 May 2026fixed in 6.15.2
- Moderateqs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustionGHSA-6rw7-vpxm-498p · 30 Dec 2025fixed in 6.14.1
- Lowqs's arrayLimit bypass in comma parsing allows denial of serviceGHSA-w7fw-mjwx-w883 · 12 Feb 2026fixed in 6.14.2
Registry facts last checked 29 Oct 2026. Releases and advisories last read 29 Oct 2026.