qs (npm)
A querystring parser and serializer with nesting support
Advisories
28
Latest version
6.17.0
Released Oct 27, 2026
License
BSD-3-Clause
OpenSSF Scorecard
5.4 / 10
How to fix
Upgrading to 6.16.1 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install qs@6.17.0yarn
yarn add qs@6.17.0pnpm
pnpm add qs@6.17.0Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-6pq8-jhm2-2vcw qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS) |
Medium EPSS 0.37% |
>= 6.7.0, < 6.16.1 | 6.16.1 |
| GHSA-6pq8-jhm2-2vcw qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS) |
Medium EPSS 0.37% |
>= 6.7.0, <= 6.16.0 | No fix yet |
| GHSA-x5fp-wj9c-mxmx qs array-limit bypass via bracket-key comma parsing |
Medium EPSS 0.54% |
>= 6.14.2, < 6.16.0 | 6.16.0 |
| GHSA-x5fp-wj9c-mxmx qs array-limit bypass via bracket-key comma parsing |
Medium EPSS 0.54% |
>= 6.14.2, <= 6.15.3 | No fix yet |
| GHSA-4mjr-xmp4-gh2g qs: Denial of Service via Attacker Controlled isBuffer |
Medium EPSS 0.40% |
>= 2.2.5, < 6.16.0 | 6.16.0 |
| GHSA-4mjr-xmp4-gh2g qs: Denial of Service via Attacker Controlled isBuffer |
Medium EPSS 0.40% |
>= 2.2.5, < 6.16.0 | 6.16.0 |
| GHSA-q8mj-m7cp-5q26 qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set |
Medium EPSS 0.40% |
>= 6.11.1, <= 6.15.1 | No fix yet |
| GHSA-q8mj-m7cp-5q26 qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set |
Medium EPSS 0.40% |
>= 6.11.1, < 6.15.2 | 6.15.2 |
| GHSA-w7fw-mjwx-w883 qs's arrayLimit bypass in comma parsing allows denial of service |
Medium EPSS 0.54% |
>= 6.7.0, <= 6.14.1 | No fix yet |
| GHSA-w7fw-mjwx-w883 qs's arrayLimit bypass in comma parsing allows denial of service |
Medium EPSS 0.54% |
>= 6.7.0, < 6.14.2 | 6.14.2 |
| GHSA-6rw7-vpxm-498p qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion |
Medium EPSS 0.45% |
< 6.14.1 | 6.14.1 |
| GHSA-6rw7-vpxm-498p qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion |
Medium EPSS 0.45% |
< 6.14.1 | 6.14.1 |
| GHSA-hrpp-h998-j3pp qs vulnerable to Prototype Pollution |
High EPSS 15.62% |
>= 6.4.0, < 6.4.1 | 6.4.1 |
| GHSA-hrpp-h998-j3pp qs vulnerable to Prototype Pollution |
High EPSS 15.62% |
>= 6.3.0, < 6.3.3 | 6.3.3 |
| GHSA-hrpp-h998-j3pp qs vulnerable to Prototype Pollution |
High EPSS 15.62% |
< 6.2.4 | 6.2.4 |
| GHSA-hrpp-h998-j3pp qs vulnerable to Prototype Pollution |
High EPSS 15.62% |
>= 6.10.0, < 6.10.3 | 6.10.3 |
| GHSA-hrpp-h998-j3pp qs vulnerable to Prototype Pollution |
High EPSS 15.62% |
>= 6.9.0, < 6.9.7 | 6.9.7 |
| GHSA-hrpp-h998-j3pp qs vulnerable to Prototype Pollution |
High EPSS 15.62% |
>= 6.8.0, < 6.8.3 | 6.8.3 |
| GHSA-hrpp-h998-j3pp qs vulnerable to Prototype Pollution |
High EPSS 15.62% |
>= 6.7.0, < 6.7.3 | 6.7.3 |
| GHSA-hrpp-h998-j3pp qs vulnerable to Prototype Pollution |
High EPSS 15.62% |
>= 6.6.0, < 6.6.1 | 6.6.1 |
| GHSA-hrpp-h998-j3pp qs vulnerable to Prototype Pollution |
High EPSS 15.62% |
>= 6.5.0, < 6.5.3 | 6.5.3 |
| GHSA-gqgv-6jq5-jjj9 Prototype Pollution Protection Bypass in qs |
High EPSS 2.42% |
>= 6.3.0, < 6.3.2 | 6.3.2 |
| GHSA-gqgv-6jq5-jjj9 Prototype Pollution Protection Bypass in qs |
High EPSS 2.42% |
>= 6.1.0, < 6.1.2 | 6.1.2 |
| GHSA-gqgv-6jq5-jjj9 Prototype Pollution Protection Bypass in qs |
High EPSS 2.42% |
< 6.0.4 | 6.0.4 |
| GHSA-gqgv-6jq5-jjj9 Prototype Pollution Protection Bypass in qs |
High EPSS 2.42% |
>= 6.2.0, < 6.2.3 | 6.2.3 |
| GHSA-crvj-3gj9-gm2p High severity vulnerability that affects qs Withdrawn |
High | < 1.0.0 | 1.0.0 |
| GHSA-f9cm-p3w6-xvr3 Denial-of-Service Extended Event Loop Blocking in qs |
High EPSS 1.38% |
< 1.0.0 | 1.0.0 |
| GHSA-jjv7-qpx3-h62q Denial-of-Service Memory Exhaustion in qs |
High EPSS 8.31% |
< 1.0.0 | 1.0.0 |
Source: git+https://github.com/ljharb/qs.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor