qs
6.17.1 · 28 Oct 2026BSD-3-Clause214.6M / weekRepositorynpmAtom feed
Upgrading qs from 2.1.0 to 2.4.2
13 releases in betweennotes for 8
- ?
- changes to make
- 0
- advisories fixed
- ?
- new
- ?
- fixes
Counted from 8 of 13 release notes. Advisories are counted from the advisory database, in full.
Security
4 advisories still affect 2.4.2
- qs: Denial of Service via Attacker Controlled isBuffermoderate · GHSA-4mjr-xmp4-gh2g
- qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustionmoderate · GHSA-6rw7-vpxm-498p
- Prototype Pollution Protection Bypass in qshigh · GHSA-gqgv-6jq5-jjj9
- qs vulnerable to Prototype Pollutionhigh · GHSA-hrpp-h998-j3pp
Upgrading to 6.16.0 clears them.
13 other lines we could not sort, mostly version bumps
- 2.4.1
#73 Property 'hasOwnProperty' of object #<Object> is not a function
- 2.4.0
#70 Add arrayFormat option
- 2.3.3
#59 make sure array indexes are >= 0, closes #57
- 2.3.3
#58 make qs usable for browser loader
- 2.3.2
#55 allow merging a string into an object
- 2.3.1
#52 Return "undefined" and "false" instead of throwing "TypeError".
- 2.3.0
#50 add option to omit array indices, closes #46
- 2.2.5
#39 Is there an alternative to Buffer.isBuffer?
- 2.2.5
#49 refactor utils.merge, fixes #45
- 2.2.0
#26 Don't use Buffer global if it's not present