{
  "@id": "urn:uuid:6f4cb706-dbca-48e0-8fef-092d59b6bd82",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T13:36:21.720801+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@2.3.3",
          "identifiers": {
            "purl": "pkg:npm/qs@2.3.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2014-10064 affects version 2.3.3 of qs.",
      "vulnerability": {
        "name": "CVE-2014-10064"
      },
      "action_statement": "Vulnerability CVE-2014-10064 affects version 2.3.3 of qs."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@2.3.3",
          "identifiers": {
            "purl": "pkg:npm/qs@2.3.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:12:46.829367+00:00",
      "status_notes": "Vulnerability CVE-2014-7191 does not affect version 2.3.3 of qs. not_affected \u2014 CVE-2014-7191 affects qs versions prior to 1.0. The target version 2.3.3-tuxcare.2 is based on upstream qs 2.3.3 (released November 2014), which already includes all three fixes for this vulnerability. The fixes were introduced in qs 1.0.x (July 2014) by upstream maintainer Nathan LaFreniere: (1) arrayLimit of 20 to prevent large array indices, (2) parameterLimit of 1000 to limit total keys, an...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-7191"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-7191 affects qs versions prior to 1.0. The target version 2.3.3-tuxcare.2 is based on upstream qs 2.3.3 (released November 2014), which already includes all three fixes for this vulnerability. The fixes were introduced in qs 1.0.x (July 2014) by upstream maintainer Nathan LaFreniere: (1) arrayLimit of 20 to prevent large array indices, (2) parameterLimit of 1000 to limit total keys, an..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@2.3.3",
          "identifiers": {
            "purl": "pkg:npm/qs@2.3.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2017-1000048 affects version 2.3.3 of qs, and is fixed in 2.3.3-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2017-1000048"
      },
      "action_statement": "Vulnerability CVE-2017-1000048 affects version 2.3.3 of qs, and is fixed in 2.3.3-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@2.3.3",
          "identifiers": {
            "purl": "pkg:npm/qs@2.3.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-24999 affects version 2.3.3 of qs, and is fixed in 2.3.3-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2022-24999"
      },
      "action_statement": "Vulnerability CVE-2022-24999 affects version 2.3.3 of qs, and is fixed in 2.3.3-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@2.3.3",
          "identifiers": {
            "purl": "pkg:npm/qs@2.3.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-15284 affects version 2.3.3 of qs, and is fixed in 2.3.3-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2025-15284"
      },
      "action_statement": "Vulnerability CVE-2025-15284 affects version 2.3.3 of qs, and is fixed in 2.3.3-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@2.3.3",
          "identifiers": {
            "purl": "pkg:npm/qs@2.3.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:02:16.356690+00:00",
      "status_notes": "Vulnerability CVE-2026-110816 does not affect version 2.3.3 of qs. not_affected \u2014 Target version 2.3.3-tuxcare.2 is not affected by CVE-2026-110816. The vulnerability requires the `arrayFormat: 'comma'` option, which was introduced in qs 6.7.0. Version 2.3.3 predates this feature entirely\u2014it only supports `indices` (true/false) for array stringification. Runtime testing confirms that passing `{ arrayFormat: 'comma' }` is silently ignored, and the target uses default indices ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-110816"
      },
      "impact_statement": "not_affected \u2014 Target version 2.3.3-tuxcare.2 is not affected by CVE-2026-110816. The vulnerability requires the `arrayFormat: 'comma'` option, which was introduced in qs 6.7.0. Version 2.3.3 predates this feature entirely\u2014it only supports `indices` (true/false) for array stringification. Runtime testing confirms that passing `{ arrayFormat: 'comma' }` is silently ignored, and the target uses default indices ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@2.3.3",
          "identifiers": {
            "purl": "pkg:npm/qs@2.3.3"
          }
        }
      ],
      "timestamp": "2026-11-06T13:36:21.720801+00:00",
      "status_notes": "Vulnerability CVE-2026-110910 does not affect version 2.3.3 of qs. not_affected \u2014 Target is qs 2.3.3-tuxcare.2, a pre-6.12 line. It has no allowEmptyArrays option and no early-return branch for empty arrays. The vulnerable code introduced in 6.12.0 is absent. Every emitted key goes through encodeURIComponent, and empty arrays emit nothing.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-110910"
      },
      "impact_statement": "not_affected \u2014 Target is qs 2.3.3-tuxcare.2, a pre-6.12 line. It has no allowEmptyArrays option and no early-return branch for empty arrays. The vulnerable code introduced in 6.12.0 is absent. Every emitted key goes through encodeURIComponent, and empty arrays emit nothing."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@2.3.3",
          "identifiers": {
            "purl": "pkg:npm/qs@2.3.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-2391 does not affect version 2.3.3 of qs. Version 2.3.3 is not vulnerable. Summary: The target repository (qs v2.3.3-tuxcare.1) is not vulnerable to CVE-2026-2391 because it predates the introduction of the comma option feature. The vulnerability requires the 'comma: true' configuration option, which does not exist in this version. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "vulnerability": {
        "name": "CVE-2026-2391"
      },
      "impact_statement": "Version 2.3.3 is not vulnerable. Summary: The target repository (qs v2.3.3-tuxcare.1) is not vulnerable to CVE-2026-2391 because it predates the introduction of the comma option feature. The vulnerability requires the 'comma: true' configuration option, which does not exist in this version. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@2.3.3",
          "identifiers": {
            "purl": "pkg:npm/qs@2.3.3"
          }
        }
      ],
      "timestamp": "2026-10-15T13:06:50.726835+00:00",
      "status_notes": "Vulnerability CVE-2026-82417 affects version 2.3.3 of qs, and is fixed in 2.3.3-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-82417"
      },
      "action_statement": "Vulnerability CVE-2026-82417 affects version 2.3.3 of qs, and is fixed in 2.3.3-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@2.3.3",
          "identifiers": {
            "purl": "pkg:npm/qs@2.3.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-82562 does not affect version 2.3.3 of qs. not_affected \u2014 Version 2.3.3 is not affected by CVE-2026-82562. The vulnerability requires comma-parsing functionality (comma: true option), the parseArrayValue function with comma-splitting logic, and the throwOnLimitExceeded option - none of which exist in this version. Testing confirms that comma-separated values like 'a[]=1,2,3,4' are treated as single string values, not split into array elements. The vul...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-82562"
      },
      "impact_statement": "not_affected \u2014 Version 2.3.3 is not affected by CVE-2026-82562. The vulnerability requires comma-parsing functionality (comma: true option), the parseArrayValue function with comma-splitting logic, and the throwOnLimitExceeded option - none of which exist in this version. Testing confirms that comma-separated values like 'a[]=1,2,3,4' are treated as single string values, not split into array elements. The vul..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@2.3.3",
          "identifiers": {
            "purl": "pkg:npm/qs@2.3.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-8723 does not affect version 2.3.3 of qs. not_affected \u2014 Version 2.3.3-tuxcare.1 is not affected by CVE-2026-8723. The vulnerability requires `arrayFormat: 'comma'` and `encodeValuesOnly: true` configuration options which were introduced in version 6.11.1 (January 2023) via commit 4c4b23d. Version 2.3.3 (circa 2014) uses a fundamentally different stringify architecture that only supports `indices` and `delimiter` options. The vulnerable code path (`u...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-8723"
      },
      "impact_statement": "not_affected \u2014 Version 2.3.3-tuxcare.1 is not affected by CVE-2026-8723. The vulnerability requires `arrayFormat: 'comma'` and `encodeValuesOnly: true` configuration options which were introduced in version 6.11.1 (January 2023) via commit 4c4b23d. Version 2.3.3 (circa 2014) uses a fundamentally different stringify architecture that only supports `indices` and `delimiter` options. The vulnerable code path (`u..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@2.3.3",
          "identifiers": {
            "purl": "pkg:npm/qs@2.3.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability GHSA-crvj-3gj9-gm2p is a false positive for qs 2.3.3.",
      "vulnerability": {
        "name": "GHSA-crvj-3gj9-gm2p"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}