{
  "@id": "urn:uuid:8b5b76b9-dee0-4319-bbf6-031f2b4d5bc8",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T13:30:25.835538+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.1.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/qs@5.1.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2014-10064 affects version 5.1.0-tuxcare.1 of qs.",
      "vulnerability": {
        "name": "CVE-2014-10064"
      },
      "action_statement": "Vulnerability CVE-2014-10064 affects version 5.1.0-tuxcare.1 of qs."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.1.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/qs@5.1.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:10:53.898872+00:00",
      "status_notes": "Vulnerability CVE-2014-7191 does not affect version 5.1.0-tuxcare.1 of qs. not_affected \u2014 CVE-2014-7191 is not present in qs version 5.1.0-tuxcare.2. The vulnerability pattern (unbounded sparse array creation from large array indices in query strings) was fixed by the upstream maintainer Nathan LaFreniere in three commits that shipped in the upstream release before TuxCare onboarded this version. All three defenses are present in the target: (1) array index limit of 20, (2) paramete...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-7191"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-7191 is not present in qs version 5.1.0-tuxcare.2. The vulnerability pattern (unbounded sparse array creation from large array indices in query strings) was fixed by the upstream maintainer Nathan LaFreniere in three commits that shipped in the upstream release before TuxCare onboarded this version. All three defenses are present in the target: (1) array index limit of 20, (2) paramete..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/qs@5.1.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/qs@5.1.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2017-1000048 is fixed in version 5.1.0-tuxcare.1 of qs.",
      "vulnerability": {
        "name": "CVE-2017-1000048"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/qs@5.1.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/qs@5.1.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-24999 is fixed in version 5.1.0-tuxcare.1 of qs.",
      "vulnerability": {
        "name": "CVE-2022-24999"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/qs@5.1.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/qs@5.1.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-15284 is fixed in version 5.1.0-tuxcare.1 of qs.",
      "vulnerability": {
        "name": "CVE-2025-15284"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.1.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/qs@5.1.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:00:38.120709+00:00",
      "status_notes": "Vulnerability CVE-2026-110816 does not affect version 5.1.0-tuxcare.1 of qs. not_affected \u2014 Target version 5.1.0 is not affected by CVE-2026-110816. The vulnerability requires the `arrayFormat: 'comma'` feature, which was introduced in qs 6.7.0. Version 5.1.0 predates this feature and does not contain the vulnerable code path. The `arrayPrefixGenerators` in this version only supports 'brackets', 'indices', and 'repeat' formats. When 'comma' is requested, it falls back to 'indices' for...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-110816"
      },
      "impact_statement": "not_affected \u2014 Target version 5.1.0 is not affected by CVE-2026-110816. The vulnerability requires the `arrayFormat: 'comma'` feature, which was introduced in qs 6.7.0. Version 5.1.0 predates this feature and does not contain the vulnerable code path. The `arrayPrefixGenerators` in this version only supports 'brackets', 'indices', and 'repeat' formats. When 'comma' is requested, it falls back to 'indices' for..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.1.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/qs@5.1.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T13:30:25.835538+00:00",
      "status_notes": "Vulnerability CVE-2026-110910 does not affect version 5.1.0-tuxcare.1 of qs. not_affected \u2014 Target is qs 5.1.0-tuxcare.2, which predates the allowEmptyArrays option (added in v6.12.0). The vulnerable early-return branch does not exist. Empty arrays serialize to nothing, so no unencoded key is emitted.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-110910"
      },
      "impact_statement": "not_affected \u2014 Target is qs 5.1.0-tuxcare.2, which predates the allowEmptyArrays option (added in v6.12.0). The vulnerable early-return branch does not exist. Empty arrays serialize to nothing, so no unencoded key is emitted."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.1.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/qs@5.1.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-2391 does not affect version 5.1.0-tuxcare.1 of qs. Version 5.1.0 is not vulnerable. Summary: The target repository (qs version 5.1.0) is NOT vulnerable to CVE-2026-2391. This vulnerability requires the 'comma' option feature which was introduced in qs version 6.x. Version 5.1.0 does not support comma-separated value parsing, making the vulnerability impossible to trigger. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-2391"
      },
      "impact_statement": "Version 5.1.0 is not vulnerable. Summary: The target repository (qs version 5.1.0) is NOT vulnerable to CVE-2026-2391. This vulnerability requires the 'comma' option feature which was introduced in qs version 6.x. Version 5.1.0 does not support comma-separated value parsing, making the vulnerability impossible to trigger. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.1.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/qs@5.1.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T10:48:00.634805+00:00",
      "status_notes": "Vulnerability CVE-2026-82417 affects version 5.1.0-tuxcare.1 of qs, and is fixed in 5.1.0-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-82417"
      },
      "action_statement": "Vulnerability CVE-2026-82417 affects version 5.1.0-tuxcare.1 of qs, and is fixed in 5.1.0-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.1.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/qs@5.1.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-82562 does not affect version 5.1.0-tuxcare.1 of qs. not_affected \u2014 The target version (5.1.0-tuxcare.1) does not contain the comma-separated array parsing feature required for CVE-2026-82562 to manifest. The vulnerability requires the `comma: true` option to parse comma-separated values into arrays, bypassing `arrayLimit` checks via bracket-key forms like `a[]=1,2,3,4`. This feature was introduced in version 6.7.0, well after the target version. Without the co...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-82562"
      },
      "impact_statement": "not_affected \u2014 The target version (5.1.0-tuxcare.1) does not contain the comma-separated array parsing feature required for CVE-2026-82562 to manifest. The vulnerability requires the `comma: true` option to parse comma-separated values into arrays, bypassing `arrayLimit` checks via bracket-key forms like `a[]=1,2,3,4`. This feature was introduced in version 6.7.0, well after the target version. Without the co..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.1.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/qs@5.1.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-8723 does not affect version 5.1.0-tuxcare.1 of qs. not_affected \u2014 Version 5.1.0-tuxcare.1 is not affected by CVE-2026-8723. The vulnerability requires the combination of `arrayFormat: 'comma'` and `encodeValuesOnly: true` options, which do not exist in this version. The vulnerable code path was introduced in commit 4c4b23d and first shipped in v6.11.1 (released 2023-01-19), while version 5.1.0 predates this by multiple major versions and uses a completely dif...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-8723"
      },
      "impact_statement": "not_affected \u2014 Version 5.1.0-tuxcare.1 is not affected by CVE-2026-8723. The vulnerability requires the combination of `arrayFormat: 'comma'` and `encodeValuesOnly: true` options, which do not exist in this version. The vulnerable code path was introduced in commit 4c4b23d and first shipped in v6.11.1 (released 2023-01-19), while version 5.1.0 predates this by multiple major versions and uses a completely dif..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.1.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/qs@5.1.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability GHSA-crvj-3gj9-gm2p is a false positive for qs 5.1.0-tuxcare.1.",
      "vulnerability": {
        "name": "GHSA-crvj-3gj9-gm2p"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}