{ "@id": "urn:uuid:de3e5a7e-a1ee-4315-bdac-efc172bb5a63", "role": "Document Creator", "author": "https://tuxcare.com", "version": 9, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T13:36:00.057506+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/qs@6.5.3", "identifiers": { "purl": "pkg:npm/qs@6.5.3" } } ], "timestamp": "2026-10-29T07:31:18.734944+00:00", "status_notes": "Vulnerability CVE-2014-10064 affects version 6.5.3 of qs.", "vulnerability": { "name": "CVE-2014-10064" }, "action_statement": "Vulnerability CVE-2014-10064 affects version 6.5.3 of qs." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@6.5.3", "identifiers": { "purl": "pkg:npm/qs@6.5.3" } } ], "timestamp": "2026-11-03T15:12:30.450582+00:00", "status_notes": "Vulnerability CVE-2014-7191 does not affect version 6.5.3 of qs. not_affected \u2014 CVE-2014-7191 is not present in qs 6.5.3-tuxcare.2. The vulnerability affected versions prior to 1.0 (released 2014). The target version 6.5.3 (released January 2022) already contains the upstream fixes from July 2014 that prevent sparse array memory exhaustion through: (1) arrayLimit of 20 to prevent large array indices, (2) parameterLimit of 1000 to limit total keys, and (3) compact() functio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-7191" }, "impact_statement": "not_affected \u2014 CVE-2014-7191 is not present in qs 6.5.3-tuxcare.2. The vulnerability affected versions prior to 1.0 (released 2014). The target version 6.5.3 (released January 2022) already contains the upstream fixes from July 2014 that prevent sparse array memory exhaustion through: (1) arrayLimit of 20 to prevent large array indices, (2) parameterLimit of 1000 to limit total keys, and (3) compact() functio..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/qs@6.5.3", "identifiers": { "purl": "pkg:npm/qs@6.5.3" } } ], "timestamp": "2026-10-29T07:31:18.734944+00:00", "status_notes": "Vulnerability CVE-2017-1000048 affects version 6.5.3 of qs.", "vulnerability": { "name": "CVE-2017-1000048" }, "action_statement": "Vulnerability CVE-2017-1000048 affects version 6.5.3 of qs." }, { "status": "affected", "products": [ { "@id": "pkg:npm/qs@6.5.3", "identifiers": { "purl": "pkg:npm/qs@6.5.3" } } ], "timestamp": "2026-10-29T07:31:18.734944+00:00", "status_notes": "Vulnerability CVE-2022-24999 affects version 6.5.3 of qs.", "vulnerability": { "name": "CVE-2022-24999" }, "action_statement": "Vulnerability CVE-2022-24999 affects version 6.5.3 of qs." }, { "status": "affected", "products": [ { "@id": "pkg:npm/qs@6.5.3", "identifiers": { "purl": "pkg:npm/qs@6.5.3" } } ], "timestamp": "2026-10-23T13:55:17.595846+00:00", "status_notes": "Vulnerability CVE-2025-15284 affects version 6.5.3 of qs, and is fixed in 6.5.3-tuxcare.2.", "vulnerability": { "name": "CVE-2025-15284" }, "action_statement": "Vulnerability CVE-2025-15284 affects version 6.5.3 of qs, and is fixed in 6.5.3-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@6.5.3", "identifiers": { "purl": "pkg:npm/qs@6.5.3" } } ], "timestamp": "2026-11-03T15:01:10.906994+00:00", "status_notes": "Vulnerability CVE-2026-110816 does not affect version 6.5.3 of qs. not_affected \u2014 Version 6.5.3 is NOT affected by CVE-2026-110816. The vulnerable `arrayFormat: 'comma'` feature was introduced in version 6.7.0, and version 6.5.3 predates this feature entirely. The target's `arrayPrefixGenerators` object contains only three array format options (brackets, indices, repeat) with no comma option. The vulnerable code path that calls `Array.prototype.join(',')` on array elements (...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-110816" }, "impact_statement": "not_affected \u2014 Version 6.5.3 is NOT affected by CVE-2026-110816. The vulnerable `arrayFormat: 'comma'` feature was introduced in version 6.7.0, and version 6.5.3 predates this feature entirely. The target's `arrayPrefixGenerators` object contains only three array format options (brackets, indices, repeat) with no comma option. The vulnerable code path that calls `Array.prototype.join(',')` on array elements (..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@6.5.3", "identifiers": { "purl": "pkg:npm/qs@6.5.3" } } ], "timestamp": "2026-11-06T13:36:00.057506+00:00", "status_notes": "Vulnerability CVE-2026-110910 does not affect version 6.5.3 of qs. not_affected \u2014 qs 6.5.3-tuxcare.2 has no allowEmptyArrays option and no early-return branch that emits an array key unencoded. The CVE says the option first shipped in v6.12.0 and earlier versions are not affected. In this target, empty arrays produce no output, so a key whose value is an empty array is never serialized.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-110910" }, "impact_statement": "not_affected \u2014 qs 6.5.3-tuxcare.2 has no allowEmptyArrays option and no early-return branch that emits an array key unencoded. The CVE says the option first shipped in v6.12.0 and earlier versions are not affected. In this target, empty arrays produce no output, so a key whose value is an empty array is never serialized." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@6.5.3", "identifiers": { "purl": "pkg:npm/qs@6.5.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2391 does not affect version 6.5.3 of qs. Version 6.5.3 is not vulnerable. Summary: The target repository (qs v6.5.3-tuxcare.1) is NOT vulnerable to CVE-2026-2391 because it does not contain the comma parsing feature that is affected by this vulnerability. The comma option was introduced in qs v6.10.0, while this repository is running v6.5.3, which predates that feature by several major releases. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2391" }, "impact_statement": "Version 6.5.3 is not vulnerable. Summary: The target repository (qs v6.5.3-tuxcare.1) is NOT vulnerable to CVE-2026-2391 because it does not contain the comma parsing feature that is affected by this vulnerability. The comma option was introduced in qs v6.10.0, while this repository is running v6.5.3, which predates that feature by several major releases. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "affected", "products": [ { "@id": "pkg:npm/qs@6.5.3", "identifiers": { "purl": "pkg:npm/qs@6.5.3" } } ], "timestamp": "2026-10-23T13:55:03.115160+00:00", "status_notes": "Vulnerability CVE-2026-82417 affects version 6.5.3 of qs, and is fixed in 6.5.3-tuxcare.2.", "vulnerability": { "name": "CVE-2026-82417" }, "action_statement": "Vulnerability CVE-2026-82417 affects version 6.5.3 of qs, and is fixed in 6.5.3-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@6.5.3", "identifiers": { "purl": "pkg:npm/qs@6.5.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-82562 does not affect version 6.5.3 of qs. not_affected \u2014 The target version (6.5.3) is not affected by CVE-2026-82562. The vulnerability requires the comma-parsing feature (`comma: true` option) which was introduced in v6.7.0, two minor versions after the target. Without this feature, the specific arrayLimit bypass described in the CVE cannot occur. This is Rule 5 Type A1: the INPUT type (comma-separated values parsed as arrays) is not received anywh...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82562" }, "impact_statement": "not_affected \u2014 The target version (6.5.3) is not affected by CVE-2026-82562. The vulnerability requires the comma-parsing feature (`comma: true` option) which was introduced in v6.7.0, two minor versions after the target. Without this feature, the specific arrayLimit bypass described in the CVE cannot occur. This is Rule 5 Type A1: the INPUT type (comma-separated values parsed as arrays) is not received anywh..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@6.5.3", "identifiers": { "purl": "pkg:npm/qs@6.5.3" } } ], "timestamp": "2026-10-07T12:21:00.152902+00:00", "status_notes": "Vulnerability CVE-2026-8723 does not affect version 6.5.3 of qs. not_affected \u2014 Target version 6.5.3 is NOT AFFECTED by CVE-2026-8723. The vulnerability requires the `arrayFormat: 'comma'` feature combined with `encodeValuesOnly: true`, which passes array elements directly to the encoder via `utils.maybeMap` without null guards. This comma arrayFormat feature was introduced in commit 04eac8d/4c4b23d (2021-2023) and first shipped in v6.11.1. Version 6.5.3 predates this feat...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-8723" }, "impact_statement": "not_affected \u2014 Target version 6.5.3 is NOT AFFECTED by CVE-2026-8723. The vulnerability requires the `arrayFormat: 'comma'` feature combined with `encodeValuesOnly: true`, which passes array elements directly to the encoder via `utils.maybeMap` without null guards. This comma arrayFormat feature was introduced in commit 04eac8d/4c4b23d (2021-2023) and first shipped in v6.11.1. Version 6.5.3 predates this feat..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@6.5.3", "identifiers": { "purl": "pkg:npm/qs@6.5.3" } } ], "timestamp": "2026-10-29T07:31:18.734944+00:00", "status_notes": "Vulnerability GHSA-crvj-3gj9-gm2p is a false positive for qs 6.5.3.", "vulnerability": { "name": "GHSA-crvj-3gj9-gm2p" }, "impact_statement": "The vulnerability has been withdrawn." } ] }