{
  "@id": "urn:uuid:72500f57-66ca-41da-a898-116c6d883927",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T13:36:00.057506+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.2.0",
          "identifiers": {
            "purl": "pkg:npm/qs@5.2.0"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2014-10064 affects version 5.2.0 of qs.",
      "vulnerability": {
        "name": "CVE-2014-10064"
      },
      "action_statement": "Vulnerability CVE-2014-10064 affects version 5.2.0 of qs."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.2.0",
          "identifiers": {
            "purl": "pkg:npm/qs@5.2.0"
          }
        }
      ],
      "timestamp": "2026-11-03T15:11:26.566722+00:00",
      "status_notes": "Vulnerability CVE-2014-7191 does not affect version 5.2.0 of qs. not_affected \u2014 CVE-2014-7191 affects qs versions prior to 1.0. The target is qs version 5.2.0-tuxcare.3, which is significantly newer and contains all three upstream defenses against sparse array memory exhaustion: (1) array index limit (arrayLimit: 20), (2) parameter count limit (parameterLimit: 1000), and (3) array compaction (Utils.compact). These fixes were shipped in the upstream qs 5.2.0 release authore...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-7191"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-7191 affects qs versions prior to 1.0. The target is qs version 5.2.0-tuxcare.3, which is significantly newer and contains all three upstream defenses against sparse array memory exhaustion: (1) array index limit (arrayLimit: 20), (2) parameter count limit (parameterLimit: 1000), and (3) array compaction (Utils.compact). These fixes were shipped in the upstream qs 5.2.0 release authore..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.2.0",
          "identifiers": {
            "purl": "pkg:npm/qs@5.2.0"
          }
        }
      ],
      "timestamp": "2026-10-23T13:51:43.329594+00:00",
      "status_notes": "Vulnerability CVE-2017-1000048 affects version 5.2.0 of qs, and is fixed in 5.2.0-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2017-1000048"
      },
      "action_statement": "Vulnerability CVE-2017-1000048 affects version 5.2.0 of qs, and is fixed in 5.2.0-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.2.0",
          "identifiers": {
            "purl": "pkg:npm/qs@5.2.0"
          }
        }
      ],
      "timestamp": "2026-10-23T13:51:43.329594+00:00",
      "status_notes": "Vulnerability CVE-2022-24999 affects version 5.2.0 of qs, and is fixed in 5.2.0-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2022-24999"
      },
      "action_statement": "Vulnerability CVE-2022-24999 affects version 5.2.0 of qs, and is fixed in 5.2.0-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.2.0",
          "identifiers": {
            "purl": "pkg:npm/qs@5.2.0"
          }
        }
      ],
      "timestamp": "2026-10-23T13:51:56.499433+00:00",
      "status_notes": "Vulnerability CVE-2025-15284 affects version 5.2.0 of qs, and is fixed in 5.2.0-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2025-15284"
      },
      "action_statement": "Vulnerability CVE-2025-15284 affects version 5.2.0 of qs, and is fixed in 5.2.0-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.2.0",
          "identifiers": {
            "purl": "pkg:npm/qs@5.2.0"
          }
        }
      ],
      "timestamp": "2026-11-03T15:02:41.455639+00:00",
      "status_notes": "Vulnerability CVE-2026-110816 does not affect version 5.2.0 of qs. not_affected \u2014 Version 5.2.0-tuxcare.3 is not affected by CVE-2026-110816. The vulnerable code path (arrayFormat: 'comma' with obj.join) was introduced in version 6.7.0 (commit b84acba), after this version. The target only supports arrayFormat options 'brackets', 'indices', and 'repeat', none of which perform the bulk array join operation that triggers the TypeError on elements with non-callable toString. CVE...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-110816"
      },
      "impact_statement": "not_affected \u2014 Version 5.2.0-tuxcare.3 is not affected by CVE-2026-110816. The vulnerable code path (arrayFormat: 'comma' with obj.join) was introduced in version 6.7.0 (commit b84acba), after this version. The target only supports arrayFormat options 'brackets', 'indices', and 'repeat', none of which perform the bulk array join operation that triggers the TypeError on elements with non-callable toString. CVE..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.2.0",
          "identifiers": {
            "purl": "pkg:npm/qs@5.2.0"
          }
        }
      ],
      "timestamp": "2026-11-06T13:36:00.057506+00:00",
      "status_notes": "Vulnerability CVE-2026-110910 does not affect version 5.2.0 of qs. not_affected \u2014 Not affected. This qs 5.2.0-tuxcare.3 has no allowEmptyArrays option, which the CVE says first appeared in v6.12.0. An empty array here produces no output, so its key is never written. Every key that is written goes through Utils.encode unless the caller sets encode:false, which the CVE itself excludes.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-110910"
      },
      "impact_statement": "not_affected \u2014 Not affected. This qs 5.2.0-tuxcare.3 has no allowEmptyArrays option, which the CVE says first appeared in v6.12.0. An empty array here produces no output, so its key is never written. Every key that is written goes through Utils.encode unless the caller sets encode:false, which the CVE itself excludes."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.2.0",
          "identifiers": {
            "purl": "pkg:npm/qs@5.2.0"
          }
        }
      ],
      "timestamp": "2026-10-20T09:57:00.071511+00:00",
      "status_notes": "Vulnerability CVE-2026-2391 does not affect version 5.2.0 of qs. Version 5.2.0 is not vulnerable. Summary: Target repository (qs v5.2.0) is not vulnerable to CVE-2026-2391. The vulnerability requires the 'comma' parsing feature which was introduced in version 6.x of the qs library and does not exist in this version. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-2391"
      },
      "impact_statement": "Version 5.2.0 is not vulnerable. Summary: Target repository (qs v5.2.0) is not vulnerable to CVE-2026-2391. The vulnerability requires the 'comma' parsing feature which was introduced in version 6.x of the qs library and does not exist in this version. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.2.0",
          "identifiers": {
            "purl": "pkg:npm/qs@5.2.0"
          }
        }
      ],
      "timestamp": "2026-10-23T13:51:56.499433+00:00",
      "status_notes": "Vulnerability CVE-2026-82417 affects version 5.2.0 of qs, and is fixed in 5.2.0-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-82417"
      },
      "action_statement": "Vulnerability CVE-2026-82417 affects version 5.2.0 of qs, and is fixed in 5.2.0-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.2.0",
          "identifiers": {
            "purl": "pkg:npm/qs@5.2.0"
          }
        }
      ],
      "timestamp": "2026-10-20T09:57:00.071511+00:00",
      "status_notes": "Vulnerability CVE-2026-82562 does not affect version 5.2.0 of qs. not_affected \u2014 The target version 5.2.0 is not affected by CVE-2026-82562. The vulnerability requires the `comma: true` parsing option and `parseArrayValue` function, which were introduced around version 6.7.0, multiple major versions after 5.2.0. Without comma-parsing support, bracket-notation inputs with comma-separated values (e.g., `a[]=1,2,3,4`) are treated as single string values rather than being split...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-82562"
      },
      "impact_statement": "not_affected \u2014 The target version 5.2.0 is not affected by CVE-2026-82562. The vulnerability requires the `comma: true` parsing option and `parseArrayValue` function, which were introduced around version 6.7.0, multiple major versions after 5.2.0. Without comma-parsing support, bracket-notation inputs with comma-separated values (e.g., `a[]=1,2,3,4`) are treated as single string values rather than being split..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.2.0",
          "identifiers": {
            "purl": "pkg:npm/qs@5.2.0"
          }
        }
      ],
      "timestamp": "2026-10-20T09:57:00.071511+00:00",
      "status_notes": "Vulnerability CVE-2026-8723 does not affect version 5.2.0 of qs. not_affected \u2014 Target version 5.2.0-tuxcare.1 is NOT AFFECTED by CVE-2026-8723. The vulnerability requires both arrayFormat: 'comma' and encodeValuesOnly: true options, neither of which exist in this version. The vulnerable code was introduced in commit 4c4b23d (2023-01-19) and first released in v6.11.1. Version 5.2.0 predates this by many major versions and only supports arrayFormat values 'brackets', 'indic...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-8723"
      },
      "impact_statement": "not_affected \u2014 Target version 5.2.0-tuxcare.1 is NOT AFFECTED by CVE-2026-8723. The vulnerability requires both arrayFormat: 'comma' and encodeValuesOnly: true options, neither of which exist in this version. The vulnerable code was introduced in commit 4c4b23d (2023-01-19) and first released in v6.11.1. Version 5.2.0 predates this by many major versions and only supports arrayFormat values 'brackets', 'indic..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.2.0",
          "identifiers": {
            "purl": "pkg:npm/qs@5.2.0"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability GHSA-crvj-3gj9-gm2p is a false positive for qs 5.2.0.",
      "vulnerability": {
        "name": "GHSA-crvj-3gj9-gm2p"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}