qs
6.17.1 · 28 Oct 2026BSD-3-Clause214.6M / weekRepositorynpmAtom feed
Upgrading qs from 6.2.0 to 6.2.1
1 release in betweenevery note read
- 0
- changes to make
- 0
- advisories fixed
- 0
- new
- 1
- fix
Security
4 advisories still affect 6.2.1
- qs: Denial of Service via Attacker Controlled isBuffermoderate · GHSA-4mjr-xmp4-gh2g
- qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustionmoderate · GHSA-6rw7-vpxm-498p
- Prototype Pollution Protection Bypass in qshigh · GHSA-gqgv-6jq5-jjj9
- qs vulnerable to Prototype Pollutionhigh · GHSA-hrpp-h998-j3pp
Upgrading to 6.16.0 clears them.
Release by release
- fixed
Ensure
key=x&key&key=yresults in 3, not 2, values
- fixed
2 other lines we could not sort, mostly version bumps
- 6.2.1
Be explicit and use
Object.prototype.hasOwnProperty.call - 6.2.1
Update
tape,eslint,@ljharb/eslint-config,qs-iconv
2 internal lines (docs, tests, tooling) left out.