qs
6.17.1 · 28 Oct 2026BSD-3-Clause214.6M / weekRepositorynpmAtom feed
Upgrading qs from 6.9.6 to 6.9.7
1 release in betweennotes for 0
- ?
- changes to make
- 1
- advisory fixed
- ?
- new
- ?
- fixes
Counted from 0 of 1 release notes. Advisories are counted from the advisory database, in full.
Security
4 advisories still affect 6.9.7
- qs: Denial of Service via Attacker Controlled isBuffermoderate · GHSA-4mjr-xmp4-gh2g
- qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)moderate · GHSA-6pq8-jhm2-2vcw
- qs's arrayLimit bypass in comma parsing allows denial of servicelow · GHSA-w7fw-mjwx-w883
- qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustionmoderate · GHSA-6rw7-vpxm-498p
Upgrading to 6.16.1 clears them.
Fixes 1 advisory affecting 6.9.6
- qs vulnerable to Prototype Pollutionhigh · GHSA-hrpp-h998-j3pp