{
  "@id": "urn:uuid:2c7e2baf-6899-4167-973b-483a06c30b10",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T13:36:00.057506+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@2.2.4",
          "identifiers": {
            "purl": "pkg:npm/qs@2.2.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2014-10064 affects version 2.2.4 of qs.",
      "vulnerability": {
        "name": "CVE-2014-10064"
      },
      "action_statement": "Vulnerability CVE-2014-10064 affects version 2.2.4 of qs."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@2.2.4",
          "identifiers": {
            "purl": "pkg:npm/qs@2.2.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:12:15.914422+00:00",
      "status_notes": "Vulnerability CVE-2014-7191 does not affect version 2.2.4 of qs. not_affected \u2014 CVE-2014-7191 affects qs versions prior to 1.0, where parsing crafted query strings with large array indices causes memory exhaustion via sparse arrays. The target version 2.2.4 is NOT vulnerable because all three upstream fixes are present: (1) parameter limit of 1000 prevents excessive key-value pairs, (2) array index limit of 20 prevents large sparse arrays (indices >20 become object keys), ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-7191"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-7191 affects qs versions prior to 1.0, where parsing crafted query strings with large array indices causes memory exhaustion via sparse arrays. The target version 2.2.4 is NOT vulnerable because all three upstream fixes are present: (1) parameter limit of 1000 prevents excessive key-value pairs, (2) array index limit of 20 prevents large sparse arrays (indices >20 become object keys), ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@2.2.4",
          "identifiers": {
            "purl": "pkg:npm/qs@2.2.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2017-1000048 affects version 2.2.4 of qs, and is fixed in 2.2.4-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2017-1000048"
      },
      "action_statement": "Vulnerability CVE-2017-1000048 affects version 2.2.4 of qs, and is fixed in 2.2.4-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@2.2.4",
          "identifiers": {
            "purl": "pkg:npm/qs@2.2.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-24999 affects version 2.2.4 of qs, and is fixed in 2.2.4-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2022-24999"
      },
      "action_statement": "Vulnerability CVE-2022-24999 affects version 2.2.4 of qs, and is fixed in 2.2.4-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@2.2.4",
          "identifiers": {
            "purl": "pkg:npm/qs@2.2.4"
          }
        }
      ],
      "timestamp": "2026-10-15T13:12:08.886878+00:00",
      "status_notes": "Vulnerability CVE-2025-15284 affects version 2.2.4 of qs, and is fixed in 2.2.4-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2025-15284"
      },
      "action_statement": "Vulnerability CVE-2025-15284 affects version 2.2.4 of qs, and is fixed in 2.2.4-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@2.2.4",
          "identifiers": {
            "purl": "pkg:npm/qs@2.2.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:01:48.956683+00:00",
      "status_notes": "Vulnerability CVE-2026-110816 does not affect version 2.2.4 of qs. not_affected \u2014 Target version 2.2.4-tuxcare.3 is NOT AFFECTED by CVE-2026-110816. The vulnerability requires the `arrayFormat: 'comma'` option, which was introduced in qs version 6.7.0. Version 2.2.4 predates this feature entirely - it has no arrayFormat option, no comma formatting logic, and no code path that performs implicit string coercion on array elements. The CVE explicitly confirms: \"releases before 6...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-110816"
      },
      "impact_statement": "not_affected \u2014 Target version 2.2.4-tuxcare.3 is NOT AFFECTED by CVE-2026-110816. The vulnerability requires the `arrayFormat: 'comma'` option, which was introduced in qs version 6.7.0. Version 2.2.4 predates this feature entirely - it has no arrayFormat option, no comma formatting logic, and no code path that performs implicit string coercion on array elements. The CVE explicitly confirms: \"releases before 6..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@2.2.4",
          "identifiers": {
            "purl": "pkg:npm/qs@2.2.4"
          }
        }
      ],
      "timestamp": "2026-11-06T13:36:00.057506+00:00",
      "status_notes": "Vulnerability CVE-2026-110910 does not affect version 2.2.4 of qs. not_affected \u2014 The target is qs 2.2.4 (TuxCare build), the same product as the advisory but a much older version. It has no `allowEmptyArrays` option and no early-return branch for empty arrays. Empty arrays produce no output, and every key that is serialized is encoded with encodeURIComponent. An empty-array key therefore never appears unencoded in the output, so the key-injection flaw (introduced in 6.12.0)...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-110910"
      },
      "impact_statement": "not_affected \u2014 The target is qs 2.2.4 (TuxCare build), the same product as the advisory but a much older version. It has no `allowEmptyArrays` option and no early-return branch for empty arrays. Empty arrays produce no output, and every key that is serialized is encoded with encodeURIComponent. An empty-array key therefore never appears unencoded in the output, so the key-injection flaw (introduced in 6.12.0)..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@2.2.4",
          "identifiers": {
            "purl": "pkg:npm/qs@2.2.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-2391 does not affect version 2.2.4 of qs. not_affected \u2014 Version 2.2.4 does not contain the comma parsing feature required for CVE-2026-2391. The vulnerability exploits the comma option to bypass arrayLimit, but this option does not exist in version 2.2.4. Comma-separated values are treated as plain strings, not parsed into arrays.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-2391"
      },
      "impact_statement": "not_affected \u2014 Version 2.2.4 does not contain the comma parsing feature required for CVE-2026-2391. The vulnerability exploits the comma option to bypass arrayLimit, but this option does not exist in version 2.2.4. Comma-separated values are treated as plain strings, not parsed into arrays."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@2.2.4",
          "identifiers": {
            "purl": "pkg:npm/qs@2.2.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:21:27.770551+00:00",
      "status_notes": "Vulnerability CVE-2026-82417 does not affect version 2.2.4 of qs. not_affected \u2014 Version 2.2.4 is NOT affected by CVE-2026-82417. The vulnerability requires duck-typing code `obj.constructor.isBuffer(obj)` that was introduced in v2.2.5 (commit 3768a75, Sept 26, 2014). Version 2.2.4 uses a safe implementation calling the global `Buffer.isBuffer(obj)` that never accesses `obj.constructor`. Live PoC test confirms the CVE exploit completes successfully without exception in v2.2.4.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-82417"
      },
      "impact_statement": "not_affected \u2014 Version 2.2.4 is NOT affected by CVE-2026-82417. The vulnerability requires duck-typing code `obj.constructor.isBuffer(obj)` that was introduced in v2.2.5 (commit 3768a75, Sept 26, 2014). Version 2.2.4 uses a safe implementation calling the global `Buffer.isBuffer(obj)` that never accesses `obj.constructor`. Live PoC test confirms the CVE exploit completes successfully without exception in v2.2.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@2.2.4",
          "identifiers": {
            "purl": "pkg:npm/qs@2.2.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-82562 does not affect version 2.2.4 of qs. not_affected \u2014 Version 2.2.4 is not affected by CVE-2026-82562. The vulnerability requires the `comma: true` parsing option, which enables splitting comma-separated values (e.g., `a[]=1,2,3,4`) into arrays. This feature was introduced in qs v6.7.0 (commit b84acba, ~2017). Version 2.2.4 (2014) predates this feature by several years and contains no comma-parsing logic. The target receives query strings that may...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-82562"
      },
      "impact_statement": "not_affected \u2014 Version 2.2.4 is not affected by CVE-2026-82562. The vulnerability requires the `comma: true` parsing option, which enables splitting comma-separated values (e.g., `a[]=1,2,3,4`) into arrays. This feature was introduced in qs v6.7.0 (commit b84acba, ~2017). Version 2.2.4 (2014) predates this feature by several years and contains no comma-parsing logic. The target receives query strings that may..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@2.2.4",
          "identifiers": {
            "purl": "pkg:npm/qs@2.2.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-8723 does not affect version 2.2.4 of qs. not_affected \u2014 Version 2.2.4 is not affected by CVE-2026-8723. The vulnerable code path (arrayFormat: 'comma' + encodeValuesOnly branch) does not exist in this version. The CVE explicitly states the vulnerability was introduced in v6.11.1, and version 2.2.4 predates this by many major versions with a completely different implementation architecture.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-8723"
      },
      "impact_statement": "not_affected \u2014 Version 2.2.4 is not affected by CVE-2026-8723. The vulnerable code path (arrayFormat: 'comma' + encodeValuesOnly branch) does not exist in this version. The CVE explicitly states the vulnerability was introduced in v6.11.1, and version 2.2.4 predates this by many major versions with a completely different implementation architecture."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@2.2.4",
          "identifiers": {
            "purl": "pkg:npm/qs@2.2.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability GHSA-crvj-3gj9-gm2p is a false positive for qs 2.2.4.",
      "vulnerability": {
        "name": "GHSA-crvj-3gj9-gm2p"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}