{ "@id": "urn:uuid:8c1048cc-b77a-452f-a3bb-3a66a6979d85", "role": "Document Creator", "author": "https://tuxcare.com", "version": 5, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-05T09:32:26.454745+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/qs@6.14.0-tuxcare.4", "identifiers": { "purl": "pkg:npm/qs@6.14.0-tuxcare.4" } } ], "timestamp": "2026-10-29T07:31:18.734944+00:00", "status_notes": "Vulnerability CVE-2014-10064 affects version 6.14.0-tuxcare.4 of qs.", "vulnerability": { "name": "CVE-2014-10064" }, "action_statement": "Vulnerability CVE-2014-10064 affects version 6.14.0-tuxcare.4 of qs." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@6.14.0-tuxcare.4", "identifiers": { "purl": "pkg:npm/qs@6.14.0-tuxcare.4" } } ], "timestamp": "2026-11-03T15:15:02.250684+00:00", "status_notes": "Vulnerability CVE-2014-7191 does not affect version 6.14.0-tuxcare.4 of qs. not_affected \u2014 CVE-2014-7191 describes a DoS vulnerability where crafted query strings with large numeric array indices (e.g., a[999999]=value) create massive sparse arrays leading to memory exhaustion. The target repository (qs 6.14.0-tuxcare.5) is NOT AFFECTED because all three upstream fixes for this CVE were already present in qs 6.14.0 when TuxCare onboarded it in August 2026. The fixes include: (1) arra...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-7191" }, "impact_statement": "not_affected \u2014 CVE-2014-7191 describes a DoS vulnerability where crafted query strings with large numeric array indices (e.g., a[999999]=value) create massive sparse arrays leading to memory exhaustion. The target repository (qs 6.14.0-tuxcare.5) is NOT AFFECTED because all three upstream fixes for this CVE were already present in qs 6.14.0 when TuxCare onboarded it in August 2026. The fixes include: (1) arra..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/qs@6.14.0-tuxcare.4", "identifiers": { "purl": "pkg:npm/qs@6.14.0-tuxcare.4" } } ], "timestamp": "2026-10-29T07:31:18.734944+00:00", "status_notes": "Vulnerability CVE-2017-1000048 affects version 6.14.0-tuxcare.4 of qs.", "vulnerability": { "name": "CVE-2017-1000048" }, "action_statement": "Vulnerability CVE-2017-1000048 affects version 6.14.0-tuxcare.4 of qs." }, { "status": "affected", "products": [ { "@id": "pkg:npm/qs@6.14.0-tuxcare.4", "identifiers": { "purl": "pkg:npm/qs@6.14.0-tuxcare.4" } } ], "timestamp": "2026-10-29T07:31:18.734944+00:00", "status_notes": "Vulnerability CVE-2022-24999 affects version 6.14.0-tuxcare.4 of qs.", "vulnerability": { "name": "CVE-2022-24999" }, "action_statement": "Vulnerability CVE-2022-24999 affects version 6.14.0-tuxcare.4 of qs." }, { "status": "affected", "products": [ { "@id": "pkg:npm/qs@6.14.0-tuxcare.4", "identifiers": { "purl": "pkg:npm/qs@6.14.0-tuxcare.4" } } ], "timestamp": "2026-11-05T09:32:26.454745+00:00", "status_notes": "Vulnerability CVE-2025-15284 affects version 6.14.0-tuxcare.4 of qs, and is fixed in 6.14.0-tuxcare.6.", "vulnerability": { "name": "CVE-2025-15284" }, "action_statement": "Vulnerability CVE-2025-15284 affects version 6.14.0-tuxcare.4 of qs, and is fixed in 6.14.0-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:npm/qs@6.14.0-tuxcare.4", "identifiers": { "purl": "pkg:npm/qs@6.14.0-tuxcare.4" } } ], "timestamp": "2026-10-31T12:24:39.926242+00:00", "status_notes": "Vulnerability CVE-2026-110816 affects version 6.14.0-tuxcare.4 of qs, and is fixed in 6.14.0-tuxcare.5.", "vulnerability": { "name": "CVE-2026-110816" }, "action_statement": "Vulnerability CVE-2026-110816 affects version 6.14.0-tuxcare.4 of qs, and is fixed in 6.14.0-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/qs@6.14.0-tuxcare.4", "identifiers": { "purl": "pkg:npm/qs@6.14.0-tuxcare.4" } } ], "timestamp": "2026-10-27T10:45:57.860007+00:00", "status_notes": "Vulnerability CVE-2026-110910 affects version 6.14.0-tuxcare.4 of qs.", "vulnerability": { "name": "CVE-2026-110910" }, "action_statement": "Vulnerability CVE-2026-110910 affects version 6.14.0-tuxcare.4 of qs." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/qs@6.14.0-tuxcare.4", "identifiers": { "purl": "pkg:npm/qs@6.14.0-tuxcare.4" } } ], "timestamp": "2026-10-27T10:45:57.860007+00:00", "status_notes": "Vulnerability CVE-2026-2391 is fixed in version 6.14.0-tuxcare.4 of qs.", "vulnerability": { "name": "CVE-2026-2391" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/qs@6.14.0-tuxcare.4", "identifiers": { "purl": "pkg:npm/qs@6.14.0-tuxcare.4" } } ], "timestamp": "2026-10-27T10:45:57.860007+00:00", "status_notes": "Vulnerability CVE-2026-82417 is fixed in version 6.14.0-tuxcare.4 of qs.", "vulnerability": { "name": "CVE-2026-82417" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/qs@6.14.0-tuxcare.4", "identifiers": { "purl": "pkg:npm/qs@6.14.0-tuxcare.4" } } ], "timestamp": "2026-10-27T10:45:57.860007+00:00", "status_notes": "Vulnerability CVE-2026-82562 is fixed in version 6.14.0-tuxcare.4 of qs.", "vulnerability": { "name": "CVE-2026-82562" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/qs@6.14.0-tuxcare.4", "identifiers": { "purl": "pkg:npm/qs@6.14.0-tuxcare.4" } } ], "timestamp": "2026-10-27T10:45:57.860007+00:00", "status_notes": "Vulnerability CVE-2026-8723 is fixed in version 6.14.0-tuxcare.4 of qs.", "vulnerability": { "name": "CVE-2026-8723" } }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@6.14.0-tuxcare.4", "identifiers": { "purl": "pkg:npm/qs@6.14.0-tuxcare.4" } } ], "timestamp": "2026-10-29T07:31:18.734944+00:00", "status_notes": "Vulnerability GHSA-crvj-3gj9-gm2p is a false positive for qs 6.14.0-tuxcare.4.", "vulnerability": { "name": "GHSA-crvj-3gj9-gm2p" }, "impact_statement": "The vulnerability has been withdrawn." } ] }