qs
6.17.1 · 28 Oct 2026BSD-3-Clause214.6M / weekRepositorynpmAtom feed
Upgrading qs from 6.14.1 to 6.14.2
1 release in betweenevery note read
- 0
- changes to make
- 1
- advisory fixed
- 0
- new
- 2
- fixes
Security
4 advisories still affect 6.14.2
- qs: Denial of Service via Attacker Controlled isBuffermoderate · GHSA-4mjr-xmp4-gh2g
- qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)moderate · GHSA-6pq8-jhm2-2vcw
- qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is setmoderate · GHSA-q8mj-m7cp-5q26
- qs array-limit bypass via bracket-key comma parsingmoderate · GHSA-x5fp-wj9c-mxmx
Upgrading to 6.16.1 clears them.
Fixes 1 advisory affecting 6.14.1
- qs's arrayLimit bypass in comma parsing allows denial of servicelow · GHSA-w7fw-mjwx-w883
Release by release
- fixed
Avoid
.push, usevoid - fixed
Fix rebase workflow permissions
- fixed
8 other lines we could not sort, mostly version bumps
- 6.14.2
parse: mark overflow objects for indexed notation exceedingarrayLimit - 6.14.2
arrayLimitmeans max count, not max index, incombine/merge/parseArrayValue - 6.14.2
parse: throw onarrayLimitexceeded with indexed notation whenthrowOnLimitExceededis true - 6.14.2
parse: enforcearrayLimitoncomma-parsed values - 6.14.2
parse: fix error message to reflect arrayLimit as max index; remove extraneous comments - 6.14.2
Document that
addQueryPrefixdoes not add?to empty output - 6.14.2
Clarify
parseArraysandarrayLimitdocumentation - 6.14.2
Replace runkit CI badge with shields.io check-runs badge
1 internal line (docs, tests, tooling) left out.