{
  "@id": "urn:uuid:ed4c2e21-2941-49fb-a939-3a41e713f93a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 12,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T13:37:00.055768+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.10.4",
          "identifiers": {
            "purl": "pkg:npm/qs@6.10.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2014-10064 affects version 6.10.4 of qs.",
      "vulnerability": {
        "name": "CVE-2014-10064"
      },
      "action_statement": "Vulnerability CVE-2014-10064 affects version 6.10.4 of qs."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.10.4",
          "identifiers": {
            "purl": "pkg:npm/qs@6.10.4"
          }
        }
      ],
      "timestamp": "2026-11-03T15:15:02.250684+00:00",
      "status_notes": "Vulnerability CVE-2014-7191 does not affect version 6.10.4 of qs. not_affected \u2014 The target repository qs version 6.10.4-tuxcare.3 is NOT affected by CVE-2014-7191. This CVE affects versions prior to 1.0 of the qs library, where parsing crafted query strings with large array indices caused memory exhaustion and process crashes. Version 6.10.4 (released June 2022) is far beyond the affected version range. The three required defenses were added by the upstream vendor (Nathan ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-7191"
      },
      "impact_statement": "not_affected \u2014 The target repository qs version 6.10.4-tuxcare.3 is NOT affected by CVE-2014-7191. This CVE affects versions prior to 1.0 of the qs library, where parsing crafted query strings with large array indices caused memory exhaustion and process crashes. Version 6.10.4 (released June 2022) is far beyond the affected version range. The three required defenses were added by the upstream vendor (Nathan ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.10.4",
          "identifiers": {
            "purl": "pkg:npm/qs@6.10.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2017-1000048 affects version 6.10.4 of qs.",
      "vulnerability": {
        "name": "CVE-2017-1000048"
      },
      "action_statement": "Vulnerability CVE-2017-1000048 affects version 6.10.4 of qs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.10.4",
          "identifiers": {
            "purl": "pkg:npm/qs@6.10.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2022-24999 affects version 6.10.4 of qs.",
      "vulnerability": {
        "name": "CVE-2022-24999"
      },
      "action_statement": "Vulnerability CVE-2022-24999 affects version 6.10.4 of qs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.10.4",
          "identifiers": {
            "purl": "pkg:npm/qs@6.10.4"
          }
        }
      ],
      "timestamp": "2026-10-16T15:27:00.175728+00:00",
      "status_notes": "Vulnerability CVE-2025-15284 affects version 6.10.4 of qs, and is fixed in 6.10.4-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2025-15284"
      },
      "action_statement": "Vulnerability CVE-2025-15284 affects version 6.10.4 of qs, and is fixed in 6.10.4-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.10.4",
          "identifiers": {
            "purl": "pkg:npm/qs@6.10.4"
          }
        }
      ],
      "timestamp": "2026-10-31T13:07:47.259962+00:00",
      "status_notes": "Vulnerability CVE-2026-110816 affects version 6.10.4 of qs, and is fixed in 6.10.4-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-110816"
      },
      "action_statement": "Vulnerability CVE-2026-110816 affects version 6.10.4 of qs, and is fixed in 6.10.4-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.10.4",
          "identifiers": {
            "purl": "pkg:npm/qs@6.10.4"
          }
        }
      ],
      "timestamp": "2026-11-06T13:37:00.055768+00:00",
      "status_notes": "Vulnerability CVE-2026-110910 does not affect version 6.10.4 of qs. not_affected \u2014 Target qs 6.10.4 (tuxcare.4) predates the allowEmptyArrays option, which first shipped in 6.12.0. The vulnerable early return for empty arrays does not exist. In this version an empty array serializes to nothing, so no unencoded key is ever emitted.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-110910"
      },
      "impact_statement": "not_affected \u2014 Target qs 6.10.4 (tuxcare.4) predates the allowEmptyArrays option, which first shipped in 6.12.0. The vulnerable early return for empty arrays does not exist. In this version an empty array serializes to nothing, so no unencoded key is ever emitted."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.10.4",
          "identifiers": {
            "purl": "pkg:npm/qs@6.10.4"
          }
        }
      ],
      "timestamp": "2026-10-16T15:27:00.175728+00:00",
      "status_notes": "Vulnerability CVE-2026-2391 affects version 6.10.4 of qs, and is fixed in 6.10.4-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-2391"
      },
      "action_statement": "Vulnerability CVE-2026-2391 affects version 6.10.4 of qs, and is fixed in 6.10.4-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.10.4",
          "identifiers": {
            "purl": "pkg:npm/qs@6.10.4"
          }
        }
      ],
      "timestamp": "2026-10-27T10:51:03.015287+00:00",
      "status_notes": "Vulnerability CVE-2026-82417 affects version 6.10.4 of qs, and is fixed in 6.10.4-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-82417"
      },
      "action_statement": "Vulnerability CVE-2026-82417 affects version 6.10.4 of qs, and is fixed in 6.10.4-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.10.4",
          "identifiers": {
            "purl": "pkg:npm/qs@6.10.4"
          }
        }
      ],
      "timestamp": "2026-11-03T16:11:47.660203+00:00",
      "status_notes": "Vulnerability CVE-2026-82562 affects version 6.10.4 of qs, and is fixed in 6.10.4-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-82562"
      },
      "action_statement": "Vulnerability CVE-2026-82562 affects version 6.10.4 of qs, and is fixed in 6.10.4-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.10.4",
          "identifiers": {
            "purl": "pkg:npm/qs@6.10.4"
          }
        }
      ],
      "timestamp": "2026-11-03T14:58:37.746578+00:00",
      "status_notes": "Vulnerability CVE-2026-8723 does not affect version 6.10.4 of qs. not_affected \u2014 Target version 6.10.4 is NOT affected by CVE-2026-8723. The vulnerability was introduced in v6.11.1 (commit 4c4b23d, 2023-01-19) and requires a specific code pattern that does not exist in 6.10.x. The CVE explicitly confirms: \"Earlier versions \u2014 including all of 6.7.x, 6.8.x, 6.9.x, 6.10.x, and 6.11.0 \u2014 implemented the comma + encodeValuesOnly path differently (joining before encoding) and are ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-8723"
      },
      "impact_statement": "not_affected \u2014 Target version 6.10.4 is NOT affected by CVE-2026-8723. The vulnerability was introduced in v6.11.1 (commit 4c4b23d, 2023-01-19) and requires a specific code pattern that does not exist in 6.10.x. The CVE explicitly confirms: \"Earlier versions \u2014 including all of 6.7.x, 6.8.x, 6.9.x, 6.10.x, and 6.11.0 \u2014 implemented the comma + encodeValuesOnly path differently (joining before encoding) and are ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.10.4",
          "identifiers": {
            "purl": "pkg:npm/qs@6.10.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability GHSA-crvj-3gj9-gm2p is a false positive for qs 6.10.4.",
      "vulnerability": {
        "name": "GHSA-crvj-3gj9-gm2p"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}