What’s Vulnerable › Products

ljharb qs vulnerabilities

5 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.

Check whether your ljharb qs version is affected

Latest ljharb qs vulnerabilities

• CVE-2026-110910 — qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection (CVSS 3.7)
• CVE-2026-110816 — qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a string (CVSS 5.3)
• CVE-2026-82562 — qs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391) (CVSS 3.7)
• CVE-2026-82417 — qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property (CVSS 5.3)
• CVE-2026-8723 — qs.stringify crashes on null/undefined entries in comma-format arrays under encodeValuesOnly (CVSS 5.3)