Skip to content
RequestGuard Vulnerabilities
Pricing
Vulnerability intelligence npm

qs

A querystring parser that supports nesting and arrays, with a depth limit

npm latest 6.16.0 BSD-3-Clause

Evidence path

Version, exploitation, severity

RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.

1

Latest version

6.16.0

No matching published advisory returned

2

Known exploitation

No KEV match

Checked by exact CVE identifier

3

Highest advisory severity

High

9 active advisories

Check an exact version

The registry confirms the version, then OSV checks advisories for that exact value.

Published records

Advisories

9
GHSA-hrpp-h998-j3pp high

qs vulnerable to Prototype Pollution

Affected range

SEMVER: introduced 6.10.0; fixed 6.10.3SEMVER: introduced 6.9.0; fixed 6.9.7SEMVER: introduced 6.8.0; fixed 6.8.3SEMVER: introduced 6.7.0; fixed 6.7.3SEMVER: introduced 6.6.0; fixed 6.6.1

Fixed versions: 6.10.3, 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, 6.2.4

CVE-2022-24999 Source ↗Source ↗
GHSA-gqgv-6jq5-jjj9 high

Prototype Pollution Protection Bypass in qs

Affected range

SEMVER: introduced 0; fixed 6.0.4SEMVER: introduced 6.1.0; fixed 6.1.2SEMVER: introduced 6.2.0; fixed 6.2.3SEMVER: introduced 6.3.0; fixed 6.3.2

Fixed versions: 6.0.4, 6.1.2, 6.2.3, 6.3.2

CVE-2017-1000048 Source ↗Source ↗
GHSA-q8mj-m7cp-5q26 moderate

qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set

Affected range

SEMVER: introduced 6.11.1; fixed 6.15.2

Fixed versions: 6.15.2

CVE-2026-8723 Source ↗Source ↗