{
  "@id": "urn:uuid:548ba574-46a7-457a-8289-a48a4bf7d699",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T13:36:00.057506+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@3.1.0",
          "identifiers": {
            "purl": "pkg:npm/qs@3.1.0"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2014-10064 affects version 3.1.0 of qs.",
      "vulnerability": {
        "name": "CVE-2014-10064"
      },
      "action_statement": "Vulnerability CVE-2014-10064 affects version 3.1.0 of qs."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@3.1.0",
          "identifiers": {
            "purl": "pkg:npm/qs@3.1.0"
          }
        }
      ],
      "timestamp": "2026-11-03T15:10:10.548488+00:00",
      "status_notes": "Vulnerability CVE-2014-7191 does not affect version 3.1.0 of qs. not_affected \u2014 CVE-2014-7191 affects qs versions prior to 1.0.0. The target repository is at version 3.1.0-tuxcare.4, which includes the upstream fixes introduced by Nathan LaFreniere in commits 4667c41c (array index limit) and bb10408f (parameter count limit). These defenses were already present in the upstream release 3.1.0 when TuxCare onboarded it (commit 7bd7fd4c). The vulnerable pattern does not exist i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-7191"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-7191 affects qs versions prior to 1.0.0. The target repository is at version 3.1.0-tuxcare.4, which includes the upstream fixes introduced by Nathan LaFreniere in commits 4667c41c (array index limit) and bb10408f (parameter count limit). These defenses were already present in the upstream release 3.1.0 when TuxCare onboarded it (commit 7bd7fd4c). The vulnerable pattern does not exist i..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@3.1.0",
          "identifiers": {
            "purl": "pkg:npm/qs@3.1.0"
          }
        }
      ],
      "timestamp": "2026-10-18T03:17:00.097088+00:00",
      "status_notes": "Vulnerability CVE-2017-1000048 affects version 3.1.0 of qs, and is fixed in 3.1.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2017-1000048"
      },
      "action_statement": "Vulnerability CVE-2017-1000048 affects version 3.1.0 of qs, and is fixed in 3.1.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@3.1.0",
          "identifiers": {
            "purl": "pkg:npm/qs@3.1.0"
          }
        }
      ],
      "timestamp": "2026-10-18T03:17:00.097088+00:00",
      "status_notes": "Vulnerability CVE-2022-24999 affects version 3.1.0 of qs, and is fixed in 3.1.0-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2022-24999"
      },
      "action_statement": "Vulnerability CVE-2022-24999 affects version 3.1.0 of qs, and is fixed in 3.1.0-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@3.1.0",
          "identifiers": {
            "purl": "pkg:npm/qs@3.1.0"
          }
        }
      ],
      "timestamp": "2026-10-18T03:17:00.097088+00:00",
      "status_notes": "Vulnerability CVE-2025-15284 affects version 3.1.0 of qs, and is fixed in 3.1.0-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2025-15284"
      },
      "action_statement": "Vulnerability CVE-2025-15284 affects version 3.1.0 of qs, and is fixed in 3.1.0-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@3.1.0",
          "identifiers": {
            "purl": "pkg:npm/qs@3.1.0"
          }
        }
      ],
      "timestamp": "2026-11-03T14:59:26.989221+00:00",
      "status_notes": "Vulnerability CVE-2026-110816 does not affect version 3.1.0 of qs. not_affected \u2014 Version 3.1.0 is not affected by CVE-2026-110816. The vulnerable comma arrayFormat feature was introduced in v6.7.0 (March 2019), nearly 4 years after v3.1.0 was released (May 2015). The target codebase does not contain the arrayFormat: 'comma' option or the vulnerable obj.join(',') code path at all. This is a clear Type A1 case where the vulnerable INPUT (comma array format processing) cannot ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-110816"
      },
      "impact_statement": "not_affected \u2014 Version 3.1.0 is not affected by CVE-2026-110816. The vulnerable comma arrayFormat feature was introduced in v6.7.0 (March 2019), nearly 4 years after v3.1.0 was released (May 2015). The target codebase does not contain the arrayFormat: 'comma' option or the vulnerable obj.join(',') code path at all. This is a clear Type A1 case where the vulnerable INPUT (comma array format processing) cannot ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@3.1.0",
          "identifiers": {
            "purl": "pkg:npm/qs@3.1.0"
          }
        }
      ],
      "timestamp": "2026-11-06T13:36:00.057506+00:00",
      "status_notes": "Vulnerability CVE-2026-110910 does not affect version 3.1.0 of qs. not_affected \u2014 Target is qs 3.1.0-tuxcare.4. It predates the allowEmptyArrays option (added in 6.12.0), so the vulnerable early return for empty arrays does not exist. Empty arrays emit nothing, and every key that is emitted goes through Utils.encode. The CVE itself says versions before 6.12.0 are not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-110910"
      },
      "impact_statement": "not_affected \u2014 Target is qs 3.1.0-tuxcare.4. It predates the allowEmptyArrays option (added in 6.12.0), so the vulnerable early return for empty arrays does not exist. Empty arrays emit nothing, and every key that is emitted goes through Utils.encode. The CVE itself says versions before 6.12.0 are not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@3.1.0",
          "identifiers": {
            "purl": "pkg:npm/qs@3.1.0"
          }
        }
      ],
      "timestamp": "2026-10-18T03:17:00.097088+00:00",
      "status_notes": "Vulnerability CVE-2026-2391 does not affect version 3.1.0 of qs. not_affected \u2014 Version 3.1.0 does not contain the comma-parsing feature that enables CVE-2026-2391. The vulnerability requires the `comma` option to parse comma-separated strings as arrays, but this feature was introduced in 2018, three years after version 3.1.0 was released in 2015. Comma-separated parameter values remain as strings and are never split into arrays, making the arrayLimit bypass impossible.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-2391"
      },
      "impact_statement": "not_affected \u2014 Version 3.1.0 does not contain the comma-parsing feature that enables CVE-2026-2391. The vulnerability requires the `comma` option to parse comma-separated strings as arrays, but this feature was introduced in 2018, three years after version 3.1.0 was released in 2015. Comma-separated parameter values remain as strings and are never split into arrays, making the arrayLimit bypass impossible."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@3.1.0",
          "identifiers": {
            "purl": "pkg:npm/qs@3.1.0"
          }
        }
      ],
      "timestamp": "2026-10-18T03:17:00.097088+00:00",
      "status_notes": "Vulnerability CVE-2026-82417 affects version 3.1.0 of qs, and is fixed in 3.1.0-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-82417"
      },
      "action_statement": "Vulnerability CVE-2026-82417 affects version 3.1.0 of qs, and is fixed in 3.1.0-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@3.1.0",
          "identifiers": {
            "purl": "pkg:npm/qs@3.1.0"
          }
        }
      ],
      "timestamp": "2026-10-18T03:17:00.097088+00:00",
      "status_notes": "Vulnerability CVE-2026-82562 does not affect version 3.1.0 of qs. not_affected \u2014 Target version 3.1.0 is not affected by CVE-2026-82562. The vulnerability requires the `comma: true` option and the `parseArrayValue()` function to parse comma-separated values within a single parameter (e.g., `a[]=1,2,3,4`). Version 3.1.0 does not have the comma-parsing feature at all - it was introduced in later v6.x versions. Testing confirms that `qs.parse('a[]=1,2,3,4', {comma: true})` ret...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-82562"
      },
      "impact_statement": "not_affected \u2014 Target version 3.1.0 is not affected by CVE-2026-82562. The vulnerability requires the `comma: true` option and the `parseArrayValue()` function to parse comma-separated values within a single parameter (e.g., `a[]=1,2,3,4`). Version 3.1.0 does not have the comma-parsing feature at all - it was introduced in later v6.x versions. Testing confirms that `qs.parse('a[]=1,2,3,4', {comma: true})` ret..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@3.1.0",
          "identifiers": {
            "purl": "pkg:npm/qs@3.1.0"
          }
        }
      ],
      "timestamp": "2026-10-18T03:17:00.097088+00:00",
      "status_notes": "Vulnerability CVE-2026-8723 does not affect version 3.1.0 of qs. not_affected \u2014 Version 3.1.0 is not affected by CVE-2026-8723. The vulnerability requires both `arrayFormat: 'comma'` and `encodeValuesOnly: true` options, neither of which exist in this version. The `comma` arrayFormat was introduced in v6.7.0 (approximately 2 years after v3.1.0's May 2015 release), and `encodeValuesOnly` was added in v6.4.0 (February 2017). The vulnerable code pattern requiring `utils.maybe...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-8723"
      },
      "impact_statement": "not_affected \u2014 Version 3.1.0 is not affected by CVE-2026-8723. The vulnerability requires both `arrayFormat: 'comma'` and `encodeValuesOnly: true` options, neither of which exist in this version. The `comma` arrayFormat was introduced in v6.7.0 (approximately 2 years after v3.1.0's May 2015 release), and `encodeValuesOnly` was added in v6.4.0 (February 2017). The vulnerable code pattern requiring `utils.maybe..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@3.1.0",
          "identifiers": {
            "purl": "pkg:npm/qs@3.1.0"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability GHSA-crvj-3gj9-gm2p is a false positive for qs 3.1.0.",
      "vulnerability": {
        "name": "GHSA-crvj-3gj9-gm2p"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}