{
  "@id": "urn:uuid:9d691070-e88e-4fda-91dd-6fb8925f157f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T13:36:00.057506+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.2.6",
          "identifiers": {
            "purl": "pkg:npm/qs@6.2.6"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2014-10064 affects version 6.2.6 of qs.",
      "vulnerability": {
        "name": "CVE-2014-10064"
      },
      "action_statement": "Vulnerability CVE-2014-10064 affects version 6.2.6 of qs."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.2.6",
          "identifiers": {
            "purl": "pkg:npm/qs@6.2.6"
          }
        }
      ],
      "timestamp": "2026-11-03T15:10:53.898872+00:00",
      "status_notes": "Vulnerability CVE-2014-7191 does not affect version 6.2.6 of qs. not_affected \u2014 CVE-2014-7191 affects qs versions prior to 1.0.0. The target version 6.2.6 contains all three upstream defenses against sparse array memory exhaustion: (1) arrayLimit restricting array indices to 20, (2) parameterLimit capping total keys at 1000, and (3) compact() function removing sparse array holes. These fixes were introduced in upstream v0.6.2 (compact) and v1.0.0 (limits) by Nathan LaFreni...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-7191"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-7191 affects qs versions prior to 1.0.0. The target version 6.2.6 contains all three upstream defenses against sparse array memory exhaustion: (1) arrayLimit restricting array indices to 20, (2) parameterLimit capping total keys at 1000, and (3) compact() function removing sparse array holes. These fixes were introduced in upstream v0.6.2 (compact) and v1.0.0 (limits) by Nathan LaFreni..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.2.6",
          "identifiers": {
            "purl": "pkg:npm/qs@6.2.6"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2017-1000048 affects version 6.2.6 of qs.",
      "vulnerability": {
        "name": "CVE-2017-1000048"
      },
      "action_statement": "Vulnerability CVE-2017-1000048 affects version 6.2.6 of qs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.2.6",
          "identifiers": {
            "purl": "pkg:npm/qs@6.2.6"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2022-24999 affects version 6.2.6 of qs.",
      "vulnerability": {
        "name": "CVE-2022-24999"
      },
      "action_statement": "Vulnerability CVE-2022-24999 affects version 6.2.6 of qs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.2.6",
          "identifiers": {
            "purl": "pkg:npm/qs@6.2.6"
          }
        }
      ],
      "timestamp": "2026-10-12T12:09:00.116657+00:00",
      "status_notes": "Vulnerability CVE-2025-15284 affects version 6.2.6 of qs, and is fixed in 6.2.6-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2025-15284"
      },
      "action_statement": "Vulnerability CVE-2025-15284 affects version 6.2.6 of qs, and is fixed in 6.2.6-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.2.6",
          "identifiers": {
            "purl": "pkg:npm/qs@6.2.6"
          }
        }
      ],
      "timestamp": "2026-11-03T15:01:10.906994+00:00",
      "status_notes": "Vulnerability CVE-2026-110816 does not affect version 6.2.6 of qs. not_affected \u2014 Target version 6.2.6 is NOT AFFECTED. The vulnerability (CVE-2026-110816) requires the `arrayFormat: 'comma'` feature, which was introduced in qs 6.7.0. Version 6.2.6 predates this feature entirely. Arrays are processed through recursive iteration that treats objects as key-value collections, never subjecting them to the implicit string coercion (via join or String()) that triggers the TypeErro...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-110816"
      },
      "impact_statement": "not_affected \u2014 Target version 6.2.6 is NOT AFFECTED. The vulnerability (CVE-2026-110816) requires the `arrayFormat: 'comma'` feature, which was introduced in qs 6.7.0. Version 6.2.6 predates this feature entirely. Arrays are processed through recursive iteration that treats objects as key-value collections, never subjecting them to the implicit string coercion (via join or String()) that triggers the TypeErro..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.2.6",
          "identifiers": {
            "purl": "pkg:npm/qs@6.2.6"
          }
        }
      ],
      "timestamp": "2026-11-06T13:36:00.057506+00:00",
      "status_notes": "Vulnerability CVE-2026-110910 does not affect version 6.2.6 of qs. not_affected \u2014 qs 6.2.6-tuxcare.2 has no allowEmptyArrays option. The vulnerable early return of the unencoded key for empty arrays does not exist. An empty array serializes to nothing, and every key that is emitted goes through the encoder.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-110910"
      },
      "impact_statement": "not_affected \u2014 qs 6.2.6-tuxcare.2 has no allowEmptyArrays option. The vulnerable early return of the unencoded key for empty arrays does not exist. An empty array serializes to nothing, and every key that is emitted goes through the encoder."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.2.6",
          "identifiers": {
            "purl": "pkg:npm/qs@6.2.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-2391 does not affect version 6.2.6 of qs. not_affected \u2014 Version 6.2.6 of qs does not contain the comma parsing feature that is vulnerable in CVE-2026-2391. The comma feature was introduced in commit b84acbab (September 2018), which is not present in v6.2.6's git ancestry. Without this feature, the vulnerability cannot manifest.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-2391"
      },
      "impact_statement": "not_affected \u2014 Version 6.2.6 of qs does not contain the comma parsing feature that is vulnerable in CVE-2026-2391. The comma feature was introduced in commit b84acbab (September 2018), which is not present in v6.2.6's git ancestry. Without this feature, the vulnerability cannot manifest."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.2.6",
          "identifiers": {
            "purl": "pkg:npm/qs@6.2.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-82417 affects version 6.2.6 of qs, and is fixed in 6.2.6-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-82417"
      },
      "action_statement": "Vulnerability CVE-2026-82417 affects version 6.2.6 of qs, and is fixed in 6.2.6-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.2.6",
          "identifiers": {
            "purl": "pkg:npm/qs@6.2.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-82562 does not affect version 6.2.6 of qs. not_affected \u2014 Target version 6.2.6 does not have the comma parsing feature that is vulnerable in CVE-2026-82562. The comma feature (comma: true option and parseArrayValue function) was introduced in commit b84acba around v6.7.0 (September 2018), approximately 140 commits after v6.2.6. Without this feature, comma-separated values in query strings are treated as literal strings, not split into arrays, so the a...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-82562"
      },
      "impact_statement": "not_affected \u2014 Target version 6.2.6 does not have the comma parsing feature that is vulnerable in CVE-2026-82562. The comma feature (comma: true option and parseArrayValue function) was introduced in commit b84acba around v6.7.0 (September 2018), approximately 140 commits after v6.2.6. Without this feature, comma-separated values in query strings are treated as literal strings, not split into arrays, so the a..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.2.6",
          "identifiers": {
            "purl": "pkg:npm/qs@6.2.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-8723 does not affect version 6.2.6 of qs. not_affected \u2014 Version 6.2.6 is not affected by CVE-2026-8723. The vulnerability requires arrayFormat:'comma' and encodeValuesOnly options that do not exist in this version. The vulnerable code path (utils.maybeMap with comma array formatting) was introduced in v6.11.1; version 6.2.6 uses a different architecture that safely handles null/undefined array elements by converting them to empty strings before enco...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-8723"
      },
      "impact_statement": "not_affected \u2014 Version 6.2.6 is not affected by CVE-2026-8723. The vulnerability requires arrayFormat:'comma' and encodeValuesOnly options that do not exist in this version. The vulnerable code path (utils.maybeMap with comma array formatting) was introduced in v6.11.1; version 6.2.6 uses a different architecture that safely handles null/undefined array elements by converting them to empty strings before enco..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.2.6",
          "identifiers": {
            "purl": "pkg:npm/qs@6.2.6"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability GHSA-crvj-3gj9-gm2p is a false positive for qs 6.2.6.",
      "vulnerability": {
        "name": "GHSA-crvj-3gj9-gm2p"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}