{ "@id": "urn:uuid:d0d25b3e-5315-49b3-bc9f-864ede09bdf3", "role": "Document Creator", "author": "https://tuxcare.com", "version": 8, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T13:36:00.057506+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/qs@1.2.2", "identifiers": { "purl": "pkg:npm/qs@1.2.2" } } ], "timestamp": "2026-10-29T07:31:18.734944+00:00", "status_notes": "Vulnerability CVE-2014-10064 affects version 1.2.2 of qs.", "vulnerability": { "name": "CVE-2014-10064" }, "action_statement": "Vulnerability CVE-2014-10064 affects version 1.2.2 of qs." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@1.2.2", "identifiers": { "purl": "pkg:npm/qs@1.2.2" } } ], "timestamp": "2026-11-03T15:10:10.548488+00:00", "status_notes": "Vulnerability CVE-2014-7191 does not affect version 1.2.2 of qs. not_affected \u2014 CVE-2014-7191 is not present in this target. All three vendor fixes (array index limit, parameter count limit, sparse array compaction) were already present in the upstream qs v1.2.2 release that TuxCare onboarded. The fixes are active by default and prevent the DoS condition described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-7191" }, "impact_statement": "not_affected \u2014 CVE-2014-7191 is not present in this target. All three vendor fixes (array index limit, parameter count limit, sparse array compaction) were already present in the upstream qs v1.2.2 release that TuxCare onboarded. The fixes are active by default and prevent the DoS condition described in the CVE." }, { "status": "affected", "products": [ { "@id": "pkg:npm/qs@1.2.2", "identifiers": { "purl": "pkg:npm/qs@1.2.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-1000048 affects version 1.2.2 of qs, and is fixed in 1.2.2-tuxcare.1.", "vulnerability": { "name": "CVE-2017-1000048" }, "action_statement": "Vulnerability CVE-2017-1000048 affects version 1.2.2 of qs, and is fixed in 1.2.2-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/qs@1.2.2", "identifiers": { "purl": "pkg:npm/qs@1.2.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-24999 affects version 1.2.2 of qs, and is fixed in 1.2.2-tuxcare.1.", "vulnerability": { "name": "CVE-2022-24999" }, "action_statement": "Vulnerability CVE-2022-24999 affects version 1.2.2 of qs, and is fixed in 1.2.2-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/qs@1.2.2", "identifiers": { "purl": "pkg:npm/qs@1.2.2" } } ], "timestamp": "2026-10-15T12:54:49.276742+00:00", "status_notes": "Vulnerability CVE-2025-15284 affects version 1.2.2 of qs, and is fixed in 1.2.2-tuxcare.4.", "vulnerability": { "name": "CVE-2025-15284" }, "action_statement": "Vulnerability CVE-2025-15284 affects version 1.2.2 of qs, and is fixed in 1.2.2-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@1.2.2", "identifiers": { "purl": "pkg:npm/qs@1.2.2" } } ], "timestamp": "2026-11-03T15:00:13.288450+00:00", "status_notes": "Vulnerability CVE-2026-110816 does not affect version 1.2.2 of qs. not_affected \u2014 Version 1.2.2 predates the introduction of the vulnerable `arrayFormat: 'comma'` feature by several major versions. The CVE explicitly states this feature was introduced in v6.7.0 and affects versions >= 6.7.0, <= 6.16.0. Version 1.2.2's stringify implementation uses a fundamentally different architecture that never performs implicit string coercion on user-controlled array elements. The vulner...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-110816" }, "impact_statement": "not_affected \u2014 Version 1.2.2 predates the introduction of the vulnerable `arrayFormat: 'comma'` feature by several major versions. The CVE explicitly states this feature was introduced in v6.7.0 and affects versions >= 6.7.0, <= 6.16.0. Version 1.2.2's stringify implementation uses a fundamentally different architecture that never performs implicit string coercion on user-controlled array elements. The vulner..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@1.2.2", "identifiers": { "purl": "pkg:npm/qs@1.2.2" } } ], "timestamp": "2026-11-06T13:36:00.057506+00:00", "status_notes": "Vulnerability CVE-2026-110910 does not affect version 1.2.2 of qs. not_affected \u2014 qs 1.2.2-tuxcare.4 has no allowEmptyArrays option and no early-return branch for empty arrays. An empty array produces no output, and every emitted key is passed through encodeURIComponent. The CVE says versions before 6.12.0 are not affected, which matches the code.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-110910" }, "impact_statement": "not_affected \u2014 qs 1.2.2-tuxcare.4 has no allowEmptyArrays option and no early-return branch for empty arrays. An empty array produces no output, and every emitted key is passed through encodeURIComponent. The CVE says versions before 6.12.0 are not affected, which matches the code." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@1.2.2", "identifiers": { "purl": "pkg:npm/qs@1.2.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2391 does not affect version 1.2.2 of qs. Version 1.2.2 is not vulnerable. Summary: Target repository is NOT vulnerable to CVE-2026-2391. The target is running qs v1.2.2-tuxcare.1, an ancient version that predates the introduction of the 'comma' option feature. The vulnerability specifically requires the 'comma: true' configuration to be enabled, which does not exist in this version. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2391" }, "impact_statement": "Version 1.2.2 is not vulnerable. Summary: Target repository is NOT vulnerable to CVE-2026-2391. The target is running qs v1.2.2-tuxcare.1, an ancient version that predates the introduction of the 'comma' option feature. The vulnerability specifically requires the 'comma: true' configuration to be enabled, which does not exist in this version. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@1.2.2", "identifiers": { "purl": "pkg:npm/qs@1.2.2" } } ], "timestamp": "2026-11-03T15:19:24.597800+00:00", "status_notes": "Vulnerability CVE-2026-82417 does not affect version 1.2.2 of qs. not_affected \u2014 Target version 1.2.2 is NOT affected by CVE-2026-82417. The vulnerability requires a `utils.isBuffer()` utility function that unsafely invokes `obj.constructor.isBuffer(obj)`, but this function does not exist in version 1.2.2. The target's utils.js is only 146 lines (vs. 327+ lines in vulnerable versions) and has no `exports.isBuffer` function. Buffer type checking is done exclusively via the s...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-82417" }, "impact_statement": "not_affected \u2014 Target version 1.2.2 is NOT affected by CVE-2026-82417. The vulnerability requires a `utils.isBuffer()` utility function that unsafely invokes `obj.constructor.isBuffer(obj)`, but this function does not exist in version 1.2.2. The target's utils.js is only 146 lines (vs. 327+ lines in vulnerable versions) and has no `exports.isBuffer` function. Buffer type checking is done exclusively via the s..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@1.2.2", "identifiers": { "purl": "pkg:npm/qs@1.2.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-82562 does not affect version 1.2.2 of qs. not_affected \u2014 Target version 1.2.2 does not have the comma parsing feature required for CVE-2026-82562. The vulnerability exploits `comma: true` option to bypass `arrayLimit` by submitting bracket-key parameters with comma-separated values (e.g., `a[]=1,2,3,4`). Version 1.2.2 lacks the `parseArrayValue` function, `comma` option, and `throwOnLimitExceeded` option entirely. When comma-separated values are pass...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82562" }, "impact_statement": "not_affected \u2014 Target version 1.2.2 does not have the comma parsing feature required for CVE-2026-82562. The vulnerability exploits `comma: true` option to bypass `arrayLimit` by submitting bracket-key parameters with comma-separated values (e.g., `a[]=1,2,3,4`). Version 1.2.2 lacks the `parseArrayValue` function, `comma` option, and `throwOnLimitExceeded` option entirely. When comma-separated values are pass..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@1.2.2", "identifiers": { "purl": "pkg:npm/qs@1.2.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8723 does not affect version 1.2.2 of qs. not_affected \u2014 Version 1.2.2 is not affected by CVE-2026-8723. The vulnerable code path requiring arrayFormat:'comma' and encodeValuesOnly options was introduced in v6.11.1 and does not exist in this version. Version 1.2.2 uses a fundamentally different, simpler architecture that explicitly handles null values by converting them to empty strings (lib/stringify.js:19-21) before any encoding operations occur, p...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-8723" }, "impact_statement": "not_affected \u2014 Version 1.2.2 is not affected by CVE-2026-8723. The vulnerable code path requiring arrayFormat:'comma' and encodeValuesOnly options was introduced in v6.11.1 and does not exist in this version. Version 1.2.2 uses a fundamentally different, simpler architecture that explicitly handles null values by converting them to empty strings (lib/stringify.js:19-21) before any encoding operations occur, p..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@1.2.2", "identifiers": { "purl": "pkg:npm/qs@1.2.2" } } ], "timestamp": "2026-10-29T07:31:18.734944+00:00", "status_notes": "Vulnerability GHSA-crvj-3gj9-gm2p is a false positive for qs 1.2.2.", "vulnerability": { "name": "GHSA-crvj-3gj9-gm2p" }, "impact_statement": "The vulnerability has been withdrawn." } ] }