qs vulnerabilities
A querystring parser that supports nesting and arrays, with a depth limit
- Registry
- npm
- Latest
- 6.16.1
- License
- BSD-3-Clause
9 known advisories
The latest version, 6.16.1, is not affected by any of them. Projects on older versions may be.
npm install qs@6.16.1Security advisories for qs
qs array-limit bypass via bracket-key comma parsing
- Affected
- >=6.14.2 <6.16.0
- Fixed in
- 6.16.0
qs: Denial of Service via Attacker Controlled isBuffer
- Affected
- >=2.2.5 <6.16.0
- Fixed in
- 6.16.0
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set
- Affected
- >=6.11.1 <6.15.2
- Fixed in
- 6.15.2
qs's arrayLimit bypass in comma parsing allows denial of service
- Affected
- >=6.7.0 <6.14.2
- Fixed in
- 6.14.2
qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion
- Affected
- <6.14.1
- Fixed in
- 6.14.1
qs vulnerable to Prototype Pollution
- Affected
- >=6.10.0 <6.10.3 · >=6.9.0 <6.9.7 · >=6.8.0 <6.8.3 · >=6.7.0 <6.7.3 · >=6.6.0 <6.6.1 · >=6.5.0 <6.5.3 · >=6.4.0 <6.4.1 · >=6.3.0 <6.3.3 · <6.2.4
- Fixed in
- 6.2.4, 6.3.3, 6.4.1, 6.5.3, 6.6.1, 6.7.3, 6.8.3, 6.9.7, 6.10.3
Prototype Pollution Protection Bypass in qs
- Affected
- <6.0.4 · >=6.1.0 <6.1.2 · >=6.2.0 <6.2.3 · >=6.3.0 <6.3.2
- Fixed in
- 6.0.4, 6.1.2, 6.2.3, 6.3.2
Denial-of-Service Extended Event Loop Blocking in qs
- Affected
- <1.0.0
- Fixed in
- 1.0.0
Denial-of-Service Memory Exhaustion in qs
- Affected
- <1.0.0
- Fixed in
- 1.0.0
Which of your client projects still run an old qs?
NPMscan reads the package-lock.json, yarn.lock and pnpm-lock.yaml in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other npm packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the npm registry.