{
  "@id": "urn:uuid:49211033-0993-4c06-bda7-cd172668984a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T13:36:00.057506+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.2.1",
          "identifiers": {
            "purl": "pkg:npm/qs@5.2.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2014-10064 affects version 5.2.1 of qs.",
      "vulnerability": {
        "name": "CVE-2014-10064"
      },
      "action_statement": "Vulnerability CVE-2014-10064 affects version 5.2.1 of qs."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.2.1",
          "identifiers": {
            "purl": "pkg:npm/qs@5.2.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:10:53.898872+00:00",
      "status_notes": "Vulnerability CVE-2014-7191 does not affect version 5.2.1 of qs. not_affected \u2014 The target version 5.2.1 is not affected by CVE-2014-7191. The vulnerability was fixed in upstream versions 1.0.2-1.0.3 (commits 4667c41 and bb10408 by Nathan LaFreniere) with three defenses: (1) limiting array indices to 20, (2) limiting query parameters to 1000, and (3) compacting sparse arrays. All defenses were already present in the upstream release before TuxCare's onboarding at commit fc...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-7191"
      },
      "impact_statement": "not_affected \u2014 The target version 5.2.1 is not affected by CVE-2014-7191. The vulnerability was fixed in upstream versions 1.0.2-1.0.3 (commits 4667c41 and bb10408 by Nathan LaFreniere) with three defenses: (1) limiting array indices to 20, (2) limiting query parameters to 1000, and (3) compacting sparse arrays. All defenses were already present in the upstream release before TuxCare's onboarding at commit fc..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.2.1",
          "identifiers": {
            "purl": "pkg:npm/qs@5.2.1"
          }
        }
      ],
      "timestamp": "2026-10-23T13:50:17.663387+00:00",
      "status_notes": "Vulnerability CVE-2017-1000048 affects version 5.2.1 of qs, and is fixed in 5.2.1-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2017-1000048"
      },
      "action_statement": "Vulnerability CVE-2017-1000048 affects version 5.2.1 of qs, and is fixed in 5.2.1-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.2.1",
          "identifiers": {
            "purl": "pkg:npm/qs@5.2.1"
          }
        }
      ],
      "timestamp": "2026-10-23T13:50:17.663387+00:00",
      "status_notes": "Vulnerability CVE-2022-24999 affects version 5.2.1 of qs, and is fixed in 5.2.1-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2022-24999"
      },
      "action_statement": "Vulnerability CVE-2022-24999 affects version 5.2.1 of qs, and is fixed in 5.2.1-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.2.1",
          "identifiers": {
            "purl": "pkg:npm/qs@5.2.1"
          }
        }
      ],
      "timestamp": "2026-10-23T13:50:17.663387+00:00",
      "status_notes": "Vulnerability CVE-2025-15284 affects version 5.2.1 of qs, and is fixed in 5.2.1-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2025-15284"
      },
      "action_statement": "Vulnerability CVE-2025-15284 affects version 5.2.1 of qs, and is fixed in 5.2.1-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.2.1",
          "identifiers": {
            "purl": "pkg:npm/qs@5.2.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:00:13.288450+00:00",
      "status_notes": "Vulnerability CVE-2026-110816 does not affect version 5.2.1 of qs. not_affected \u2014 Version 5.2.1-tuxcare.4 is not affected by CVE-2026-110816. The vulnerability requires the `arrayFormat: 'comma'` feature, which triggers `obj.join(',')` on array elements, causing a TypeError when elements have non-callable `toString` properties. This feature was introduced in qs v6.7.0 (commit b84acba, September 2018). Version 5.2.1 predates this feature entirely\u2014its `arrayPrefixGenerators` o...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-110816"
      },
      "impact_statement": "not_affected \u2014 Version 5.2.1-tuxcare.4 is not affected by CVE-2026-110816. The vulnerability requires the `arrayFormat: 'comma'` feature, which triggers `obj.join(',')` on array elements, causing a TypeError when elements have non-callable `toString` properties. This feature was introduced in qs v6.7.0 (commit b84acba, September 2018). Version 5.2.1 predates this feature entirely\u2014its `arrayPrefixGenerators` o..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.2.1",
          "identifiers": {
            "purl": "pkg:npm/qs@5.2.1"
          }
        }
      ],
      "timestamp": "2026-11-06T13:36:00.057506+00:00",
      "status_notes": "Vulnerability CVE-2026-110910 does not affect version 5.2.1 of qs. not_affected \u2014 Target is qs 5.2.1-tuxcare.4. The allowEmptyArrays option and its early return (the unencoded key plus '[]') were first introduced in qs 6.12.0 and do not exist here. In this version an empty array emits nothing, so no unencoded key text reaches the output.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-110910"
      },
      "impact_statement": "not_affected \u2014 Target is qs 5.2.1-tuxcare.4. The allowEmptyArrays option and its early return (the unencoded key plus '[]') were first introduced in qs 6.12.0 and do not exist here. In this version an empty array emits nothing, so no unencoded key text reaches the output."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.2.1",
          "identifiers": {
            "purl": "pkg:npm/qs@5.2.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-2391 does not affect version 5.2.1 of qs. not_affected \u2014 The target repository (qs v5.2.1) is not affected by CVE-2026-2391. This vulnerability requires the `comma: true` option to enable parsing of comma-separated values into arrays, bypassing the `arrayLimit` enforcement. The `comma` option was introduced in qs v6.7.0 (commit b84acba, September 2018), which is well after v5.2.1. Since the feature does not exist in this version, the vulnerability ca...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-2391"
      },
      "impact_statement": "not_affected \u2014 The target repository (qs v5.2.1) is not affected by CVE-2026-2391. This vulnerability requires the `comma: true` option to enable parsing of comma-separated values into arrays, bypassing the `arrayLimit` enforcement. The `comma` option was introduced in qs v6.7.0 (commit b84acba, September 2018), which is well after v5.2.1. Since the feature does not exist in this version, the vulnerability ca..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.2.1",
          "identifiers": {
            "purl": "pkg:npm/qs@5.2.1"
          }
        }
      ],
      "timestamp": "2026-10-23T13:50:17.663387+00:00",
      "status_notes": "Vulnerability CVE-2026-82417 affects version 5.2.1 of qs, and is fixed in 5.2.1-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-82417"
      },
      "action_statement": "Vulnerability CVE-2026-82417 affects version 5.2.1 of qs, and is fixed in 5.2.1-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.2.1",
          "identifiers": {
            "purl": "pkg:npm/qs@5.2.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-82562 does not affect version 5.2.1 of qs. not_affected \u2014 The target qs version 5.2.1 is NOT affected by CVE-2026-82562. The vulnerability requires the `comma: true` option to enable comma-separated value parsing within individual query parameters (e.g., `a[]=1,2,3,4` parsed as four elements). This feature does not exist in version 5.2.1 - it was introduced in a later version. In 5.2.1, comma-separated values are treated as literal strings, not split ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-82562"
      },
      "impact_statement": "not_affected \u2014 The target qs version 5.2.1 is NOT affected by CVE-2026-82562. The vulnerability requires the `comma: true` option to enable comma-separated value parsing within individual query parameters (e.g., `a[]=1,2,3,4` parsed as four elements). This feature does not exist in version 5.2.1 - it was introduced in a later version. In 5.2.1, comma-separated values are treated as literal strings, not split ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.2.1",
          "identifiers": {
            "purl": "pkg:npm/qs@5.2.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-8723 does not affect version 5.2.1 of qs. not_affected \u2014 Version 5.2.1 is not affected by CVE-2026-8723. The vulnerability was introduced in commit 4c4b23d and first released in v6.11.1. Version 5.2.1 predates this vulnerable code by multiple major versions and lacks the arrayFormat='comma' option entirely. The existing code architecture safely handles null/undefined array elements through guards in the stringify function that prevent raw null/undefi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-8723"
      },
      "impact_statement": "not_affected \u2014 Version 5.2.1 is not affected by CVE-2026-8723. The vulnerability was introduced in commit 4c4b23d and first released in v6.11.1. Version 5.2.1 predates this vulnerable code by multiple major versions and lacks the arrayFormat='comma' option entirely. The existing code architecture safely handles null/undefined array elements through guards in the stringify function that prevent raw null/undefi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@5.2.1",
          "identifiers": {
            "purl": "pkg:npm/qs@5.2.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability GHSA-crvj-3gj9-gm2p is a false positive for qs 5.2.1.",
      "vulnerability": {
        "name": "GHSA-crvj-3gj9-gm2p"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}