{ "@id": "urn:uuid:bff62cb0-cf53-4f9a-854c-b3aa85eefc5d", "role": "Document Creator", "author": "https://tuxcare.com", "version": 6, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T13:37:00.055768+00:00", "statements": [ { "status": "fixed", "products": [ { "@id": "pkg:npm/qs@0.4.2-tuxcare.1", "identifiers": { "purl": "pkg:npm/qs@0.4.2-tuxcare.1" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2014-10064 is fixed in version 0.4.2-tuxcare.1 of qs.", "vulnerability": { "name": "CVE-2014-10064" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/qs@0.4.2-tuxcare.1", "identifiers": { "purl": "pkg:npm/qs@0.4.2-tuxcare.1" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2014-7191 is fixed in version 0.4.2-tuxcare.1 of qs.", "vulnerability": { "name": "CVE-2014-7191" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/qs@0.4.2-tuxcare.1", "identifiers": { "purl": "pkg:npm/qs@0.4.2-tuxcare.1" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2017-1000048 is fixed in version 0.4.2-tuxcare.1 of qs.", "vulnerability": { "name": "CVE-2017-1000048" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/qs@0.4.2-tuxcare.1", "identifiers": { "purl": "pkg:npm/qs@0.4.2-tuxcare.1" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2022-24999 is fixed in version 0.4.2-tuxcare.1 of qs.", "vulnerability": { "name": "CVE-2022-24999" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/qs@0.4.2-tuxcare.1", "identifiers": { "purl": "pkg:npm/qs@0.4.2-tuxcare.1" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2025-15284 is fixed in version 0.4.2-tuxcare.1 of qs.", "vulnerability": { "name": "CVE-2025-15284" } }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@0.4.2-tuxcare.1", "identifiers": { "purl": "pkg:npm/qs@0.4.2-tuxcare.1" } } ], "timestamp": "2026-11-03T15:02:41.455639+00:00", "status_notes": "Vulnerability CVE-2026-110816 does not affect version 0.4.2-tuxcare.1 of qs. not_affected \u2014 Target version 0.4.2 is not affected by CVE-2026-110816. The vulnerability requires the `arrayFormat: 'comma'` option in `qs.stringify`, which was introduced in version 6.7.0. Version 0.4.2 predates this feature by approximately 4 years and has no mechanism to accept an `arrayFormat` option. The CVE explicitly states \"releases before 6.7.0 lack the sink.\" Comprehensive code analysis confirms th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-110816" }, "impact_statement": "not_affected \u2014 Target version 0.4.2 is not affected by CVE-2026-110816. The vulnerability requires the `arrayFormat: 'comma'` option in `qs.stringify`, which was introduced in version 6.7.0. Version 0.4.2 predates this feature by approximately 4 years and has no mechanism to accept an `arrayFormat` option. The CVE explicitly states \"releases before 6.7.0 lack the sink.\" Comprehensive code analysis confirms th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@0.4.2-tuxcare.1", "identifiers": { "purl": "pkg:npm/qs@0.4.2-tuxcare.1" } } ], "timestamp": "2026-11-06T13:37:00.055768+00:00", "status_notes": "Vulnerability CVE-2026-110910 does not affect version 0.4.2-tuxcare.1 of qs. not_affected \u2014 Target is qs 0.4.2-tuxcare.1, the same product but a far older version. It has no allowEmptyArrays option and no early return that skips key encoding. An empty array produces no output, and every key that is emitted goes through encodeURIComponent. Not affected. The CVE lists only 6.12.0 and later as affected.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-110910" }, "impact_statement": "not_affected \u2014 Target is qs 0.4.2-tuxcare.1, the same product but a far older version. It has no allowEmptyArrays option and no early return that skips key encoding. An empty array produces no output, and every key that is emitted goes through encodeURIComponent. Not affected. The CVE lists only 6.12.0 and later as affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@0.4.2-tuxcare.1", "identifiers": { "purl": "pkg:npm/qs@0.4.2-tuxcare.1" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-2391 does not affect version 0.4.2-tuxcare.1 of qs. not_affected \u2014 Version 0.4.2 is not affected by CVE-2026-2391. The vulnerability requires the `comma: true` option to be enabled, which allows parsing comma-separated values as arrays (e.g., `?a=1,2,3` \u2192 `['1','2','3']`). This feature does not exist in version 0.4.2. The comma option was introduced in later versions (6.x+) via commit b84acba, which is not an ancestor of version 0.4.2. Version 0.4.2's parse() ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2391" }, "impact_statement": "not_affected \u2014 Version 0.4.2 is not affected by CVE-2026-2391. The vulnerability requires the `comma: true` option to be enabled, which allows parsing comma-separated values as arrays (e.g., `?a=1,2,3` \u2192 `['1','2','3']`). This feature does not exist in version 0.4.2. The comma option was introduced in later versions (6.x+) via commit b84acba, which is not an ancestor of version 0.4.2. Version 0.4.2's parse() ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@0.4.2-tuxcare.1", "identifiers": { "purl": "pkg:npm/qs@0.4.2-tuxcare.1" } } ], "timestamp": "2026-11-03T15:20:07.841451+00:00", "status_notes": "Vulnerability CVE-2026-82417 does not affect version 0.4.2-tuxcare.1 of qs. not_affected \u2014 Target version 0.4.2 is NOT affected by CVE-2026-82417. The vulnerability affects the utils.isBuffer() function which calls obj.constructor.isBuffer(obj) without type-checking, causing DoS when a non-callable value is passed. This function was introduced in qs v2.2.5 (per upstream patch). Version 0.4.2 predates this introduction by multiple major versions and contains no isBuffer logic, no util...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-82417" }, "impact_statement": "not_affected \u2014 Target version 0.4.2 is NOT affected by CVE-2026-82417. The vulnerability affects the utils.isBuffer() function which calls obj.constructor.isBuffer(obj) without type-checking, causing DoS when a non-callable value is passed. This function was introduced in qs v2.2.5 (per upstream patch). Version 0.4.2 predates this introduction by multiple major versions and contains no isBuffer logic, no util..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@0.4.2-tuxcare.1", "identifiers": { "purl": "pkg:npm/qs@0.4.2-tuxcare.1" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-82562 does not affect version 0.4.2-tuxcare.1 of qs. not_affected \u2014 Version 0.4.2 is not affected by CVE-2026-82562. The vulnerable code path (comma parsing with the `comma: true` option, `throwOnLimitExceeded` option, and the `parseArrayValue` function with `isFlatArrayValue` gate) does not exist in this version. These features were added in much later versions (6.14.0+). Version 0.4.2 only splits query strings on `&` (ampersand) and does not support comma-sep...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82562" }, "impact_statement": "not_affected \u2014 Version 0.4.2 is not affected by CVE-2026-82562. The vulnerable code path (comma parsing with the `comma: true` option, `throwOnLimitExceeded` option, and the `parseArrayValue` function with `isFlatArrayValue` gate) does not exist in this version. These features were added in much later versions (6.14.0+). Version 0.4.2 only splits query strings on `&` (ampersand) and does not support comma-sep..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@0.4.2-tuxcare.1", "identifiers": { "purl": "pkg:npm/qs@0.4.2-tuxcare.1" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-8723 does not affect version 0.4.2-tuxcare.1 of qs. not_affected \u2014 Target qs v0.4.2-tuxcare.1 is not affected by CVE-2026-8723. The vulnerability requires stringify to be called with both `arrayFormat: 'comma'` and `encodeValuesOnly: true` options, causing null/undefined array elements to crash when passed to the encoder. Target v0.4.2 has a fundamentally different architecture: stringify(obj, prefix) with no options parameter, no support for arrayFormat or en...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-8723" }, "impact_statement": "not_affected \u2014 Target qs v0.4.2-tuxcare.1 is not affected by CVE-2026-8723. The vulnerability requires stringify to be called with both `arrayFormat: 'comma'` and `encodeValuesOnly: true` options, causing null/undefined array elements to crash when passed to the encoder. Target v0.4.2 has a fundamentally different architecture: stringify(obj, prefix) with no options parameter, no support for arrayFormat or en..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@0.4.2-tuxcare.1", "identifiers": { "purl": "pkg:npm/qs@0.4.2-tuxcare.1" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability GHSA-crvj-3gj9-gm2p is a false positive for qs 0.4.2-tuxcare.1.", "vulnerability": { "name": "GHSA-crvj-3gj9-gm2p" }, "impact_statement": "The vulnerability has been withdrawn." } ] }