{ "@id": "urn:uuid:29422f44-09ed-4062-b4bd-b5ff3092268a", "role": "Document Creator", "author": "https://tuxcare.com", "version": 14, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T13:37:00.055768+00:00", "statements": [ { "status": "fixed", "products": [ { "@id": "pkg:npm/qs@0.6.5-tuxcare.1", "identifiers": { "purl": "pkg:npm/qs@0.6.5-tuxcare.1" } } ], "timestamp": "2026-10-07T11:53:00.166677+00:00", "status_notes": "Vulnerability CVE-2014-10064 is fixed in version 0.6.5-tuxcare.1 of qs.", "vulnerability": { "name": "CVE-2014-10064" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/qs@0.6.5-tuxcare.1", "identifiers": { "purl": "pkg:npm/qs@0.6.5-tuxcare.1" } } ], "timestamp": "2026-10-07T11:51:00.118793+00:00", "status_notes": "Vulnerability CVE-2014-7191 is fixed in version 0.6.5-tuxcare.1 of qs.", "vulnerability": { "name": "CVE-2014-7191" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/qs@0.6.5-tuxcare.1", "identifiers": { "purl": "pkg:npm/qs@0.6.5-tuxcare.1" } } ], "timestamp": "2026-10-07T11:53:00.166677+00:00", "status_notes": "Vulnerability CVE-2017-1000048 is fixed in version 0.6.5-tuxcare.1 of qs.", "vulnerability": { "name": "CVE-2017-1000048" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/qs@0.6.5-tuxcare.1", "identifiers": { "purl": "pkg:npm/qs@0.6.5-tuxcare.1" } } ], "timestamp": "2026-10-07T11:54:00.132166+00:00", "status_notes": "Vulnerability CVE-2022-24999 is fixed in version 0.6.5-tuxcare.1 of qs.", "vulnerability": { "name": "CVE-2022-24999" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/qs@0.6.5-tuxcare.1", "identifiers": { "purl": "pkg:npm/qs@0.6.5-tuxcare.1" } } ], "timestamp": "2026-10-07T11:52:15.252963+00:00", "status_notes": "Vulnerability CVE-2025-15284 is fixed in version 0.6.5-tuxcare.1 of qs.", "vulnerability": { "name": "CVE-2025-15284" } }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@0.6.5-tuxcare.1", "identifiers": { "purl": "pkg:npm/qs@0.6.5-tuxcare.1" } } ], "timestamp": "2026-11-03T15:03:40.830954+00:00", "status_notes": "Vulnerability CVE-2026-110816 does not affect version 0.6.5-tuxcare.1 of qs. not_affected \u2014 Version 0.6.5 is NOT affected by CVE-2026-110816. The vulnerability requires the `arrayFormat: 'comma'` option which was introduced in qs 6.7.0. Version 0.6.5 has no `arrayFormat` parameter, no comma-join array processing, and a fundamentally different architecture. Arrays are always serialized with bracket notation (arr[0]=val&arr[1]=val) via individual element processing, never batch-coerced ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-110816" }, "impact_statement": "not_affected \u2014 Version 0.6.5 is NOT affected by CVE-2026-110816. The vulnerability requires the `arrayFormat: 'comma'` option which was introduced in qs 6.7.0. Version 0.6.5 has no `arrayFormat` parameter, no comma-join array processing, and a fundamentally different architecture. Arrays are always serialized with bracket notation (arr[0]=val&arr[1]=val) via individual element processing, never batch-coerced ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@0.6.5-tuxcare.1", "identifiers": { "purl": "pkg:npm/qs@0.6.5-tuxcare.1" } } ], "timestamp": "2026-11-06T13:37:00.055768+00:00", "status_notes": "Vulnerability CVE-2026-110910 does not affect version 0.6.5-tuxcare.1 of qs. not_affected \u2014 qs 0.6.5-tuxcare.1 predates the allowEmptyArrays option (added in 6.12.0), so the vulnerable early return does not exist. Every key emitted by stringifyObject is passed through encodeURIComponent, and an empty array emits nothing, so a key containing '&', '=' or '#' cannot become query syntax.", "vulnerability": { "name": "CVE-2026-110910" }, "impact_statement": "not_affected \u2014 qs 0.6.5-tuxcare.1 predates the allowEmptyArrays option (added in 6.12.0), so the vulnerable early return does not exist. Every key emitted by stringifyObject is passed through encodeURIComponent, and an empty array emits nothing, so a key containing '&', '=' or '#' cannot become query syntax." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@0.6.5-tuxcare.1", "identifiers": { "purl": "pkg:npm/qs@0.6.5-tuxcare.1" } } ], "timestamp": "2026-10-07T12:47:00.234886+00:00", "status_notes": "Vulnerability CVE-2026-2391 does not affect version 0.6.5-tuxcare.1 of qs. not_affected \u2014 Version 0.6.5 is not affected by CVE-2026-2391. The vulnerability requires the `comma` option feature to parse comma-separated values into arrays, but this feature does not exist in version 0.6.5 (released 2013-05-13). The `comma` option was introduced in later 6.x versions. In 0.6.5, the parse function takes only a string parameter with no options support, and comma-separated values are treate...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2391" }, "impact_statement": "not_affected \u2014 Version 0.6.5 is not affected by CVE-2026-2391. The vulnerability requires the `comma` option feature to parse comma-separated values into arrays, but this feature does not exist in version 0.6.5 (released 2013-05-13). The `comma` option was introduced in later 6.x versions. In 0.6.5, the parse function takes only a string parameter with no options support, and comma-separated values are treate..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@0.6.5-tuxcare.1", "identifiers": { "purl": "pkg:npm/qs@0.6.5-tuxcare.1" } } ], "timestamp": "2026-11-03T15:21:12.185577+00:00", "status_notes": "Vulnerability CVE-2026-82417 does not affect version 0.6.5-tuxcare.1 of qs. not_affected \u2014 Version 0.6.5 is NOT affected by CVE-2026-82417. The vulnerable code pattern (utils.isBuffer duck-type check that calls obj.constructor.isBuffer without type verification) does not exist in this version. Version 0.6.5 predates the lib/ directory architecture introduced in later versions; all code resides in index.js with no isBuffer function. The stringify implementation uses only safe type che...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82417" }, "impact_statement": "not_affected \u2014 Version 0.6.5 is NOT affected by CVE-2026-82417. The vulnerable code pattern (utils.isBuffer duck-type check that calls obj.constructor.isBuffer without type verification) does not exist in this version. Version 0.6.5 predates the lib/ directory architecture introduced in later versions; all code resides in index.js with no isBuffer function. The stringify implementation uses only safe type che..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@0.6.5-tuxcare.1", "identifiers": { "purl": "pkg:npm/qs@0.6.5-tuxcare.1" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2026-82562 does not affect version 0.6.5-tuxcare.1 of qs. not_affected \u2014 Version 0.6.5 of the qs library is not affected by CVE-2026-82562. This CVE concerns a bypass of arrayLimit enforcement when using comma-separated values with bracket notation (e.g., `a[]=1,2,3,4` with `comma: true` option). Version 0.6.5 does not support comma-separated value parsing at all - it lacks the `comma` option, the `parseArrayValue` function, and any comma-splitting logic. Commas in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82562" }, "impact_statement": "not_affected \u2014 Version 0.6.5 of the qs library is not affected by CVE-2026-82562. This CVE concerns a bypass of arrayLimit enforcement when using comma-separated values with bracket notation (e.g., `a[]=1,2,3,4` with `comma: true` option). Version 0.6.5 does not support comma-separated value parsing at all - it lacks the `comma` option, the `parseArrayValue` function, and any comma-splitting logic. Commas in ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@0.6.5-tuxcare.1", "identifiers": { "purl": "pkg:npm/qs@0.6.5-tuxcare.1" } } ], "timestamp": "2026-10-07T12:48:00.161442+00:00", "status_notes": "Vulnerability CVE-2026-8723 does not affect version 0.6.5-tuxcare.1 of qs. not_affected \u2014 Version 0.6.5 is NOT AFFECTED by CVE-2026-8723. The vulnerability requires `arrayFormat: 'comma'` and `encodeValuesOnly: true` options that were introduced in v6.11.1 (2023). Version 0.6.5 (circa 2012) uses a completely different architecture with no options API, and safely handles null/undefined through String() conversion at line 320 of index.js. The vulnerable code pattern (`utils.maybeMap` ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-8723" }, "impact_statement": "not_affected \u2014 Version 0.6.5 is NOT AFFECTED by CVE-2026-8723. The vulnerability requires `arrayFormat: 'comma'` and `encodeValuesOnly: true` options that were introduced in v6.11.1 (2023). Version 0.6.5 (circa 2012) uses a completely different architecture with no options API, and safely handles null/undefined through String() conversion at line 320 of index.js. The vulnerable code pattern (`utils.maybeMap` ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/qs@0.6.5-tuxcare.1", "identifiers": { "purl": "pkg:npm/qs@0.6.5-tuxcare.1" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability GHSA-crvj-3gj9-gm2p is a false positive for qs 0.6.5-tuxcare.1.", "vulnerability": { "name": "GHSA-crvj-3gj9-gm2p" }, "impact_statement": "The vulnerability has been withdrawn." } ] }