{ "@id": "urn:uuid:02746ec5-6c06-4701-8b6c-b99594650b34", "role": "Document Creator", "author": "https://tuxcare.com", "version": 7, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T13:30:25.835538+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/qs@1.0.2", "identifiers": { "purl": "pkg:npm/qs@1.0.2" } } ], "timestamp": "2026-10-29T07:31:18.734944+00:00", "status_notes": "Vulnerability CVE-2014-10064 affects version 1.0.2 of qs.", "vulnerability": { "name": "CVE-2014-10064" }, "action_statement": "Vulnerability CVE-2014-10064 affects version 1.0.2 of qs." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@1.0.2", "identifiers": { "purl": "pkg:npm/qs@1.0.2" } } ], "timestamp": "2026-11-03T15:09:27.722120+00:00", "status_notes": "Vulnerability CVE-2014-7191 does not affect version 1.0.2 of qs. not_affected \u2014 The target (qs v1.0.2-tuxcare.3) is not affected by CVE-2014-7191. The CVE affects versions prior to 1.0, and the target is version 1.0.2, which already contains the upstream vendor's fix. The vulnerable pattern (unbounded array index allocation leading to sparse array memory exhaustion) was removed by upstream commit 4667c41c authored by Nathan LaFreniere, which shipped in the upstream v1.0.2 ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-7191" }, "impact_statement": "not_affected \u2014 The target (qs v1.0.2-tuxcare.3) is not affected by CVE-2014-7191. The CVE affects versions prior to 1.0, and the target is version 1.0.2, which already contains the upstream vendor's fix. The vulnerable pattern (unbounded array index allocation leading to sparse array memory exhaustion) was removed by upstream commit 4667c41c authored by Nathan LaFreniere, which shipped in the upstream v1.0.2 ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@1.0.2", "identifiers": { "purl": "pkg:npm/qs@1.0.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-1000048 does not affect version 1.0.2 of qs. already_fixed \u2014 CVE-2017-1000048 has already been fixed in this repository. TuxCare commit 87a4daf (Dec 25, 2025) backported the prototype pollution protections, and all defense mechanisms are present in the current code at HEAD 614c63d.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-1000048" }, "impact_statement": "already_fixed \u2014 CVE-2017-1000048 has already been fixed in this repository. TuxCare commit 87a4daf (Dec 25, 2025) backported the prototype pollution protections, and all defense mechanisms are present in the current code at HEAD 614c63d." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@1.0.2", "identifiers": { "purl": "pkg:npm/qs@1.0.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-24999 does not affect version 1.0.2 of qs. already_fixed \u2014 The target repository (qs version 1.0.2-tuxcare.1) already contains the fix for CVE-2022-24999. The vulnerability was addressed in commit 72fc431 on 2025-12-24, which added the '__proto__' key filtering defense to lib/parse.js at line 67. This fix prevents prototype pollution attacks by explicitly rejecting property assignments when the parsed key equals '__proto__'.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-24999" }, "impact_statement": "already_fixed \u2014 The target repository (qs version 1.0.2-tuxcare.1) already contains the fix for CVE-2022-24999. The vulnerability was addressed in commit 72fc431 on 2025-12-24, which added the '__proto__' key filtering defense to lib/parse.js at line 67. This fix prevents prototype pollution attacks by explicitly rejecting property assignments when the parsed key equals '__proto__'." }, { "status": "affected", "products": [ { "@id": "pkg:npm/qs@1.0.2", "identifiers": { "purl": "pkg:npm/qs@1.0.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15284 affects version 1.0.2 of qs, and is fixed in 1.0.2-tuxcare.1.", "vulnerability": { "name": "CVE-2025-15284" }, "action_statement": "Vulnerability CVE-2025-15284 affects version 1.0.2 of qs, and is fixed in 1.0.2-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@1.0.2", "identifiers": { "purl": "pkg:npm/qs@1.0.2" } } ], "timestamp": "2026-11-03T15:00:38.120709+00:00", "status_notes": "Vulnerability CVE-2026-110816 does not affect version 1.0.2 of qs. not_affected \u2014 CVE-2026-110816 affects qs versions >= 6.7.0 where the `arrayFormat: 'comma'` option was introduced. The target version 1.0.2 predates this feature entirely. The vulnerability requires the comma array format to collapse arrays via `obj.join(',')`, performing unguarded string coercion on elements. Version 1.0.2 has a simple 53-line stringify.js with no options parameter, no arrayFormat support, ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-110816" }, "impact_statement": "not_affected \u2014 CVE-2026-110816 affects qs versions >= 6.7.0 where the `arrayFormat: 'comma'` option was introduced. The target version 1.0.2 predates this feature entirely. The vulnerability requires the comma array format to collapse arrays via `obj.join(',')`, performing unguarded string coercion on elements. Version 1.0.2 has a simple 53-line stringify.js with no options parameter, no arrayFormat support, ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@1.0.2", "identifiers": { "purl": "pkg:npm/qs@1.0.2" } } ], "timestamp": "2026-11-06T13:30:25.835538+00:00", "status_notes": "Vulnerability CVE-2026-110910 does not affect version 1.0.2 of qs. not_affected \u2014 Not affected. qs 1.0.2-tuxcare.3 predates the allowEmptyArrays option (added in 6.12.0) and has no early-return path that emits an unencoded key. Every key is passed through encodeURIComponent on every path, and an empty array or empty object produces no output at all.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-110910" }, "impact_statement": "not_affected \u2014 Not affected. qs 1.0.2-tuxcare.3 predates the allowEmptyArrays option (added in 6.12.0) and has no early-return path that emits an unencoded key. Every key is passed through encodeURIComponent on every path, and an empty array or empty object produces no output at all." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@1.0.2", "identifiers": { "purl": "pkg:npm/qs@1.0.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2391 does not affect version 1.0.2 of qs. not_affected \u2014 Target version 1.0.2 is not affected by CVE-2026-2391. The vulnerability requires the comma-parsing feature (enabled via `comma: true` option), which does not exist in this version. Version 1.0.2 uses a simple parsing architecture that lacks configurable options and only splits on '&' to separate parameters. Comma-separated values within a single parameter remain as strings and are not parsed i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2391" }, "impact_statement": "not_affected \u2014 Target version 1.0.2 is not affected by CVE-2026-2391. The vulnerability requires the comma-parsing feature (enabled via `comma: true` option), which does not exist in this version. Version 1.0.2 uses a simple parsing architecture that lacks configurable options and only splits on '&' to separate parameters. Comma-separated values within a single parameter remain as strings and are not parsed i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@1.0.2", "identifiers": { "purl": "pkg:npm/qs@1.0.2" } } ], "timestamp": "2026-11-03T15:18:59.019571+00:00", "status_notes": "Vulnerability CVE-2026-82417 does not affect version 1.0.2 of qs. not_affected \u2014 Version 1.0.2 is not affected by CVE-2026-82417. The vulnerability requires a custom utils.isBuffer() function that duck-types buffers via obj.constructor.isBuffer(obj) without checking if it's callable. This pattern was introduced in upstream v2.2.5 and does not exist in v1.0.2. The target uses Node.js Buffer.isBuffer() directly, which uses internal brand checks and cannot be exploited by obje...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-82417" }, "impact_statement": "not_affected \u2014 Version 1.0.2 is not affected by CVE-2026-82417. The vulnerability requires a custom utils.isBuffer() function that duck-types buffers via obj.constructor.isBuffer(obj) without checking if it's callable. This pattern was introduced in upstream v2.2.5 and does not exist in v1.0.2. The target uses Node.js Buffer.isBuffer() directly, which uses internal brand checks and cannot be exploited by obje..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@1.0.2", "identifiers": { "purl": "pkg:npm/qs@1.0.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-82562 does not affect version 1.0.2 of qs. not_affected \u2014 Version 1.0.2 is NOT affected by CVE-2026-82562. The vulnerability requires the `comma: true` parsing option and the `parseArrayValue()` function, both of which do not exist in this version. Version 1.0.2 predates the comma-parsing feature entirely and treats comma characters as literal string content rather than array separators. Runtime testing confirms that `a[]=1,2,3,4` is parsed as a singl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82562" }, "impact_statement": "not_affected \u2014 Version 1.0.2 is NOT affected by CVE-2026-82562. The vulnerability requires the `comma: true` parsing option and the `parseArrayValue()` function, both of which do not exist in this version. Version 1.0.2 predates the comma-parsing feature entirely and treats comma characters as literal string content rather than array separators. Runtime testing confirms that `a[]=1,2,3,4` is parsed as a singl..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@1.0.2", "identifiers": { "purl": "pkg:npm/qs@1.0.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8723 does not affect version 1.0.2 of qs. not_affected \u2014 Target version 1.0.2 is not affected by CVE-2026-8723. The vulnerability requires the arrayFormat: 'comma' and encodeValuesOnly: true options, which do not exist in v1.0.2. The vulnerable code pattern (utils.maybeMap calling an unguarded encoder) was introduced in v6.11.1, approximately 5 major versions after 1.0.2. The target uses a fundamentally different architecture with explicit null handl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-8723" }, "impact_statement": "not_affected \u2014 Target version 1.0.2 is not affected by CVE-2026-8723. The vulnerability requires the arrayFormat: 'comma' and encodeValuesOnly: true options, which do not exist in v1.0.2. The vulnerable code pattern (utils.maybeMap calling an unguarded encoder) was introduced in v6.11.1, approximately 5 major versions after 1.0.2. The target uses a fundamentally different architecture with explicit null handl..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@1.0.2", "identifiers": { "purl": "pkg:npm/qs@1.0.2" } } ], "timestamp": "2026-10-29T07:31:18.734944+00:00", "status_notes": "Vulnerability GHSA-crvj-3gj9-gm2p is a false positive for qs 1.0.2.", "vulnerability": { "name": "GHSA-crvj-3gj9-gm2p" }, "impact_statement": "The vulnerability has been withdrawn." } ] }