{
  "@id": "urn:uuid:33ab3b1d-90de-4f0c-ba5e-e5dfb7ec04d2",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T13:37:00.055768+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.10.3",
          "identifiers": {
            "purl": "pkg:npm/qs@6.10.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2014-10064 affects version 6.10.3 of qs.",
      "vulnerability": {
        "name": "CVE-2014-10064"
      },
      "action_statement": "Vulnerability CVE-2014-10064 affects version 6.10.3 of qs."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.10.3",
          "identifiers": {
            "purl": "pkg:npm/qs@6.10.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:13:50.465041+00:00",
      "status_notes": "Vulnerability CVE-2014-7191 does not affect version 6.10.3 of qs. not_affected \u2014 CVE-2014-7191 (sparse array memory exhaustion DoS) is NOT present in qs version 6.10.3. The vulnerability affected versions prior to 1.0.0, where parsing strings like \"a[999999999]=1\" created large sparse JavaScript arrays causing memory exhaustion. The upstream vendor (ljharb/qs) fixed this in commit 4667c41 by limiting array indices to 20 by default, limiting parameters to 1000, and compactin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-7191"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-7191 (sparse array memory exhaustion DoS) is NOT present in qs version 6.10.3. The vulnerability affected versions prior to 1.0.0, where parsing strings like \"a[999999999]=1\" created large sparse JavaScript arrays causing memory exhaustion. The upstream vendor (ljharb/qs) fixed this in commit 4667c41 by limiting array indices to 20 by default, limiting parameters to 1000, and compactin..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.10.3",
          "identifiers": {
            "purl": "pkg:npm/qs@6.10.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2017-1000048 affects version 6.10.3 of qs.",
      "vulnerability": {
        "name": "CVE-2017-1000048"
      },
      "action_statement": "Vulnerability CVE-2017-1000048 affects version 6.10.3 of qs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.10.3",
          "identifiers": {
            "purl": "pkg:npm/qs@6.10.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2022-24999 affects version 6.10.3 of qs.",
      "vulnerability": {
        "name": "CVE-2022-24999"
      },
      "action_statement": "Vulnerability CVE-2022-24999 affects version 6.10.3 of qs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.10.3",
          "identifiers": {
            "purl": "pkg:npm/qs@6.10.3"
          }
        }
      ],
      "timestamp": "2026-10-23T13:57:20.510318+00:00",
      "status_notes": "Vulnerability CVE-2025-15284 affects version 6.10.3 of qs, and is fixed in 6.10.3-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2025-15284"
      },
      "action_statement": "Vulnerability CVE-2025-15284 affects version 6.10.3 of qs, and is fixed in 6.10.3-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.10.3",
          "identifiers": {
            "purl": "pkg:npm/qs@6.10.3"
          }
        }
      ],
      "timestamp": "2026-10-31T13:07:06.593284+00:00",
      "status_notes": "Vulnerability CVE-2026-110816 affects version 6.10.3 of qs, and is fixed in 6.10.3-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-110816"
      },
      "action_statement": "Vulnerability CVE-2026-110816 affects version 6.10.3 of qs, and is fixed in 6.10.3-tuxcare.5."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.10.3",
          "identifiers": {
            "purl": "pkg:npm/qs@6.10.3"
          }
        }
      ],
      "timestamp": "2026-11-06T13:37:00.055768+00:00",
      "status_notes": "Vulnerability CVE-2026-110910 does not affect version 6.10.3 of qs. not_affected \u2014 Not affected. qs 6.10.3-tuxcare.5 has no allowEmptyArrays option or code path. The CVE says the flaw is an early return in the allowEmptyArrays branch, shipped from v6.12.0, and that earlier versions are not affected. In this target an empty array yields no output, and every key that is emitted is encoded.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-110910"
      },
      "impact_statement": "not_affected \u2014 Not affected. qs 6.10.3-tuxcare.5 has no allowEmptyArrays option or code path. The CVE says the flaw is an early return in the allowEmptyArrays branch, shipped from v6.12.0, and that earlier versions are not affected. In this target an empty array yields no output, and every key that is emitted is encoded."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.10.3",
          "identifiers": {
            "purl": "pkg:npm/qs@6.10.3"
          }
        }
      ],
      "timestamp": "2026-10-23T13:57:00.173375+00:00",
      "status_notes": "Vulnerability CVE-2026-2391 affects version 6.10.3 of qs, and is fixed in 6.10.3-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-2391"
      },
      "action_statement": "Vulnerability CVE-2026-2391 affects version 6.10.3 of qs, and is fixed in 6.10.3-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.10.3",
          "identifiers": {
            "purl": "pkg:npm/qs@6.10.3"
          }
        }
      ],
      "timestamp": "2026-10-23T13:57:20.510318+00:00",
      "status_notes": "Vulnerability CVE-2026-82417 affects version 6.10.3 of qs, and is fixed in 6.10.3-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-82417"
      },
      "action_statement": "Vulnerability CVE-2026-82417 affects version 6.10.3 of qs, and is fixed in 6.10.3-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.10.3",
          "identifiers": {
            "purl": "pkg:npm/qs@6.10.3"
          }
        }
      ],
      "timestamp": "2026-10-23T13:57:20.510318+00:00",
      "status_notes": "Vulnerability CVE-2026-82562 affects version 6.10.3 of qs, and is fixed in 6.10.3-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-82562"
      },
      "action_statement": "Vulnerability CVE-2026-82562 affects version 6.10.3 of qs, and is fixed in 6.10.3-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.10.3",
          "identifiers": {
            "purl": "pkg:npm/qs@6.10.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-8723 does not affect version 6.10.3 of qs. not_affected \u2014 CVE-2026-8723 does NOT affect qs v6.10.3. The vulnerability-specific code pattern (encoding array elements before joining in the comma+encodeValuesOnly path) does not exist in this version. Version 6.10.3 uses a different implementation that joins arrays first (converting null to empty string), then processes the resulting string, preventing raw null/undefined from reaching the encoder. The CVE...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-8723"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-8723 does NOT affect qs v6.10.3. The vulnerability-specific code pattern (encoding array elements before joining in the comma+encodeValuesOnly path) does not exist in this version. Version 6.10.3 uses a different implementation that joins arrays first (converting null to empty string), then processes the resulting string, preventing raw null/undefined from reaching the encoder. The CVE..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.10.3",
          "identifiers": {
            "purl": "pkg:npm/qs@6.10.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability GHSA-crvj-3gj9-gm2p is a false positive for qs 6.10.3.",
      "vulnerability": {
        "name": "GHSA-crvj-3gj9-gm2p"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}