ljharb qs
5 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-110910 | 6.12.0 – < 6.12.6 ; 6.13.0 – < 6.13.4 ; 6.14.0 – < 6.14.3 ; … | qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-110816 | 6.7.0 – < 6.16.1 | qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a string | MEDIUM 6.3 | 0.4 % | ||
| CVE-2026-82562 | 6.14.2 – < 6.16.0 | qs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-202… | MEDIUM 6.3 | 0.5 % | ||
| CVE-2026-82417 | 2.2.5 – < 6.16.0 | qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property | MEDIUM 6.3 | 0.4 % | ||
| CVE-2026-8723 | 6.11.1 – < 6.15.2 | qs.stringify crashes on null/undefined entries in comma-format arrays under encodeValuesOnly | MEDIUM 6.3 | 0.4 % |