{
  "@id": "urn:uuid:4291a0ef-e331-4bff-ab05-ad846af755e5",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T13:35:00.092946+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.5.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.5.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2014-10064 affects version 6.5.5-tuxcare.1 of qs.",
      "vulnerability": {
        "name": "CVE-2014-10064"
      },
      "action_statement": "Vulnerability CVE-2014-10064 affects version 6.5.5-tuxcare.1 of qs."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.5.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.5.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:11:26.566722+00:00",
      "status_notes": "Vulnerability CVE-2014-7191 does not affect version 6.5.5-tuxcare.1 of qs. not_affected \u2014 CVE-2014-7191 affects qs versions prior to 1.0.0 due to the ability to create large sparse arrays via crafted query strings, causing memory exhaustion. The target (qs 6.5.5-tuxcare.2) contains all three upstream defenses that prevent this vulnerability: (1) arrayLimit restricting indices to \u226420, (2) parameterLimit limiting total keys to 1000, and (3) compact() removing sparse array holes. These...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-7191"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-7191 affects qs versions prior to 1.0.0 due to the ability to create large sparse arrays via crafted query strings, causing memory exhaustion. The target (qs 6.5.5-tuxcare.2) contains all three upstream defenses that prevent this vulnerability: (1) arrayLimit restricting indices to \u226420, (2) parameterLimit limiting total keys to 1000, and (3) compact() removing sparse array holes. These..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.5.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.5.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2017-1000048 affects version 6.5.5-tuxcare.1 of qs.",
      "vulnerability": {
        "name": "CVE-2017-1000048"
      },
      "action_statement": "Vulnerability CVE-2017-1000048 affects version 6.5.5-tuxcare.1 of qs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.5.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.5.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2022-24999 affects version 6.5.5-tuxcare.1 of qs.",
      "vulnerability": {
        "name": "CVE-2022-24999"
      },
      "action_statement": "Vulnerability CVE-2022-24999 affects version 6.5.5-tuxcare.1 of qs."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/qs@6.5.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.5.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-15284 is fixed in version 6.5.5-tuxcare.1 of qs.",
      "vulnerability": {
        "name": "CVE-2025-15284"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.5.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.5.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:01:48.956683+00:00",
      "status_notes": "Vulnerability CVE-2026-110816 does not affect version 6.5.5-tuxcare.1 of qs. not_affected \u2014 Version 6.5.5 is NOT AFFECTED by CVE-2026-110816. The vulnerable `arrayFormat: 'comma'` feature was introduced in qs 6.7.0 (commit b84acba), AFTER this version. The target lacks the vulnerable code path entirely: the `comma` option does not exist in `arrayPrefixGenerators`, and there is no `obj.join(',')` branch that could trigger implicit string coercion on array elements with non-callable `to...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-110816"
      },
      "impact_statement": "not_affected \u2014 Version 6.5.5 is NOT AFFECTED by CVE-2026-110816. The vulnerable `arrayFormat: 'comma'` feature was introduced in qs 6.7.0 (commit b84acba), AFTER this version. The target lacks the vulnerable code path entirely: the `comma` option does not exist in `arrayPrefixGenerators`, and there is no `obj.join(',')` branch that could trigger implicit string coercion on array elements with non-callable `to..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.5.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.5.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T13:35:00.092946+00:00",
      "status_notes": "Vulnerability CVE-2026-110910 does not affect version 6.5.5-tuxcare.1 of qs. not_affected \u2014 qs 6.5.5-tuxcare.2 predates the allowEmptyArrays option (introduced in qs 6.12.0), and the vulnerable early-return branch does not exist in lib/stringify.js. Empty arrays produce no output at all, so a key with query-syntax characters and an empty-array value is never emitted unencoded. Every other path that emits a key encodes it through the encoder. The exceptions are the intentional encode:f...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-110910"
      },
      "impact_statement": "not_affected \u2014 qs 6.5.5-tuxcare.2 predates the allowEmptyArrays option (introduced in qs 6.12.0), and the vulnerable early-return branch does not exist in lib/stringify.js. Empty arrays produce no output at all, so a key with query-syntax characters and an empty-array value is never emitted unencoded. Every other path that emits a key encodes it through the encoder. The exceptions are the intentional encode:f..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.5.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.5.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-2391 does not affect version 6.5.5-tuxcare.1 of qs. not_affected \u2014 Target version 6.5.5 does not contain the comma parsing feature required for this vulnerability. The comma option was introduced in v6.7.0, two minor versions after the target. Without comma parsing, comma-separated query parameter values remain as single strings and cannot bypass arrayLimit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-2391"
      },
      "impact_statement": "not_affected \u2014 Target version 6.5.5 does not contain the comma parsing feature required for this vulnerability. The comma option was introduced in v6.7.0, two minor versions after the target. Without comma parsing, comma-separated query parameter values remain as single strings and cannot bypass arrayLimit."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.5.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.5.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T10:48:00.634805+00:00",
      "status_notes": "Vulnerability CVE-2026-82417 affects version 6.5.5-tuxcare.1 of qs, and is fixed in 6.5.5-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-82417"
      },
      "action_statement": "Vulnerability CVE-2026-82417 affects version 6.5.5-tuxcare.1 of qs, and is fixed in 6.5.5-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.5.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.5.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-82562 does not affect version 6.5.5-tuxcare.1 of qs. not_affected \u2014 Target version 6.5.5 is not affected by CVE-2026-82562. The vulnerability requires the comma-parsing feature (comma: true option, parseArrayValue function, and throwOnLimitExceeded option), which was introduced in v6.7.0. This version predates that feature by two minor versions and has none of the required components. Input like a[]=1,2,3,4 is treated as a single string value, not split into mu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-82562"
      },
      "impact_statement": "not_affected \u2014 Target version 6.5.5 is not affected by CVE-2026-82562. The vulnerability requires the comma-parsing feature (comma: true option, parseArrayValue function, and throwOnLimitExceeded option), which was introduced in v6.7.0. This version predates that feature by two minor versions and has none of the required components. Input like a[]=1,2,3,4 is treated as a single string value, not split into mu..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.5.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.5.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-8723 does not affect version 6.5.5-tuxcare.1 of qs. not_affected \u2014 Version 6.5.5 is not affected by CVE-2026-8723. The vulnerability requires the arrayFormat: 'comma' feature combined with encodeValuesOnly: true, which was introduced in v6.11.1. Version 6.5.5 lacks both the comma arrayFormat implementation and the utils.maybeMap function that the vulnerable code path relies on.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-8723"
      },
      "impact_statement": "not_affected \u2014 Version 6.5.5 is not affected by CVE-2026-8723. The vulnerability requires the arrayFormat: 'comma' feature combined with encodeValuesOnly: true, which was introduced in v6.11.1. Version 6.5.5 lacks both the comma arrayFormat implementation and the utils.maybeMap function that the vulnerable code path relies on."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.5.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.5.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability GHSA-crvj-3gj9-gm2p is a false positive for qs 6.5.5-tuxcare.1.",
      "vulnerability": {
        "name": "GHSA-crvj-3gj9-gm2p"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}