{
  "@id": "urn:uuid:c83a3e2b-7e33-4ac3-bac9-1cffd2ee5896",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-07T15:15:00.197567+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.9.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.9.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2014-10064 affects version 6.9.1 of qs.",
      "vulnerability": {
        "name": "CVE-2014-10064"
      },
      "action_statement": "Vulnerability CVE-2014-10064 affects version 6.9.1 of qs."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.9.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.9.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:14:37.389349+00:00",
      "status_notes": "Vulnerability CVE-2014-7191 does not affect version 6.9.1 of qs. not_affected \u2014 CVE-2014-7191 affects qs versions prior to 1.0.0. The target is version 6.9.1, which contains all upstream fixes for this vulnerability: arrayLimit defaults to 20 (preventing large sparse arrays from array indices), parameterLimit defaults to 1000 (limiting total parameters), and sparse array compaction removes undefined holes. These defenses were added in commits from 2014-2016 by upstream mai...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-7191"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-7191 affects qs versions prior to 1.0.0. The target is version 6.9.1, which contains all upstream fixes for this vulnerability: arrayLimit defaults to 20 (preventing large sparse arrays from array indices), parameterLimit defaults to 1000 (limiting total parameters), and sparse array compaction removes undefined holes. These defenses were added in commits from 2014-2016 by upstream mai..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.9.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.9.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2017-1000048 affects version 6.9.1 of qs.",
      "vulnerability": {
        "name": "CVE-2017-1000048"
      },
      "action_statement": "Vulnerability CVE-2017-1000048 affects version 6.9.1 of qs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.9.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.9.1"
          }
        }
      ],
      "timestamp": "2026-10-15T12:43:34.212015+00:00",
      "status_notes": "Vulnerability CVE-2022-24999 affects version 6.9.1 of qs.",
      "vulnerability": {
        "name": "CVE-2022-24999"
      },
      "action_statement": "Vulnerability CVE-2022-24999 affects version 6.9.1 of qs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.9.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.9.1"
          }
        }
      ],
      "timestamp": "2026-10-15T12:43:34.212015+00:00",
      "status_notes": "Vulnerability CVE-2025-15284 affects version 6.9.1 of qs.",
      "vulnerability": {
        "name": "CVE-2025-15284"
      },
      "action_statement": "Vulnerability CVE-2025-15284 affects version 6.9.1 of qs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.9.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.9.1"
          }
        }
      ],
      "timestamp": "2026-11-07T15:15:00.197567+00:00",
      "status_notes": "Vulnerability CVE-2026-110816 affects version 6.9.1 of qs, and is fixed in 6.9.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-110816"
      },
      "action_statement": "Vulnerability CVE-2026-110816 affects version 6.9.1 of qs, and is fixed in 6.9.1-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.9.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.9.1"
          }
        }
      ],
      "timestamp": "2026-11-06T13:37:46.015474+00:00",
      "status_notes": "Vulnerability CVE-2026-110910 does not affect version 6.9.1 of qs. not_affected \u2014 Target is qs 6.9.1. The allowEmptyArrays option, which CVE-2026-110910 concerns, does not exist in this version (it first shipped in 6.12.0). An empty array here produces no output, so its key is never serialized, encoded or not. Every key that does get serialized goes through the encoder. Not affected.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-110910"
      },
      "impact_statement": "not_affected \u2014 Target is qs 6.9.1. The allowEmptyArrays option, which CVE-2026-110910 concerns, does not exist in this version (it first shipped in 6.12.0). An empty array here produces no output, so its key is never serialized, encoded or not. Every key that does get serialized goes through the encoder. Not affected."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.9.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.9.1"
          }
        }
      ],
      "timestamp": "2026-10-15T12:43:34.212015+00:00",
      "status_notes": "Vulnerability CVE-2026-2391 affects version 6.9.1 of qs.",
      "vulnerability": {
        "name": "CVE-2026-2391"
      },
      "action_statement": "Vulnerability CVE-2026-2391 affects version 6.9.1 of qs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.9.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.9.1"
          }
        }
      ],
      "timestamp": "2026-11-07T15:15:00.197567+00:00",
      "status_notes": "Vulnerability CVE-2026-82417 affects version 6.9.1 of qs, and is fixed in 6.9.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-82417"
      },
      "action_statement": "Vulnerability CVE-2026-82417 affects version 6.9.1 of qs, and is fixed in 6.9.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.9.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.9.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2026-82562 affects version 6.9.1 of qs.",
      "vulnerability": {
        "name": "CVE-2026-82562"
      },
      "action_statement": "Vulnerability CVE-2026-82562 affects version 6.9.1 of qs."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.9.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.9.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:58:07.747368+00:00",
      "status_notes": "Vulnerability CVE-2026-8723 does not affect version 6.9.1 of qs. not_affected \u2014 Version 6.9.1 is not affected by CVE-2026-8723. The vulnerable code pattern (utils.maybeMap applying encoder before join) does not exist in this version. Version 6.9.1 uses a different architecture that joins arrays before encoding, safely converting null elements to empty strings. The vulnerability was introduced later in v6.11.1 when the implementation was changed to map the encoder over arra...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-8723"
      },
      "impact_statement": "not_affected \u2014 Version 6.9.1 is not affected by CVE-2026-8723. The vulnerable code pattern (utils.maybeMap applying encoder before join) does not exist in this version. Version 6.9.1 uses a different architecture that joins arrays before encoding, safely converting null elements to empty strings. The vulnerability was introduced later in v6.11.1 when the implementation was changed to map the encoder over arra..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.9.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.9.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability GHSA-crvj-3gj9-gm2p is a false positive for qs 6.9.1.",
      "vulnerability": {
        "name": "GHSA-crvj-3gj9-gm2p"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}