{
  "@id": "urn:uuid:56222095-1e4a-450e-bc97-aef3fd5a9500",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T15:35:29.309896+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.14.2",
          "identifiers": {
            "purl": "pkg:npm/qs@6.14.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2014-10064 affects version 6.14.2 of qs.",
      "vulnerability": {
        "name": "CVE-2014-10064"
      },
      "action_statement": "Vulnerability CVE-2014-10064 affects version 6.14.2 of qs."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.14.2",
          "identifiers": {
            "purl": "pkg:npm/qs@6.14.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:15:02.250684+00:00",
      "status_notes": "Vulnerability CVE-2014-7191 does not affect version 6.14.2 of qs. not_affected \u2014 CVE-2014-7191 affects qs versions prior to 1.0.0 through denial of service via sparse array memory exhaustion. The target (qs 6.14.2-tuxcare.2) contains all three upstream defenses introduced in July 2014 by Nathan LaFreniere: (1) arrayLimit=20 preventing indices above 20, (2) parameterLimit=1000 limiting total parameters, (3) compact() removing sparse array holes. These defenses are enabled by...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-7191"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-7191 affects qs versions prior to 1.0.0 through denial of service via sparse array memory exhaustion. The target (qs 6.14.2-tuxcare.2) contains all three upstream defenses introduced in July 2014 by Nathan LaFreniere: (1) arrayLimit=20 preventing indices above 20, (2) parameterLimit=1000 limiting total parameters, (3) compact() removing sparse array holes. These defenses are enabled by..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.14.2",
          "identifiers": {
            "purl": "pkg:npm/qs@6.14.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2017-1000048 affects version 6.14.2 of qs.",
      "vulnerability": {
        "name": "CVE-2017-1000048"
      },
      "action_statement": "Vulnerability CVE-2017-1000048 affects version 6.14.2 of qs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.14.2",
          "identifiers": {
            "purl": "pkg:npm/qs@6.14.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2022-24999 affects version 6.14.2 of qs.",
      "vulnerability": {
        "name": "CVE-2022-24999"
      },
      "action_statement": "Vulnerability CVE-2022-24999 affects version 6.14.2 of qs."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.14.2",
          "identifiers": {
            "purl": "pkg:npm/qs@6.14.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:33:21.899203+00:00",
      "status_notes": "Vulnerability CVE-2025-15284 does not affect version 6.14.2 of qs. not_affected \u2014 CVE-2025-15284 is not present in the target. The vulnerability (arrayLimit bypass via bracket notation) was fixed by upstream commit 3086902 authored by Jordan Harband, which was already present in the upstream release before TuxCare onboarded version 6.14.2. The fix modifies lib/parse.js to pass arrayLimit to utils.combine() for bracket notation (lines 182-195) and introduces overflow tracking...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-15284"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-15284 is not present in the target. The vulnerability (arrayLimit bypass via bracket notation) was fixed by upstream commit 3086902 authored by Jordan Harband, which was already present in the upstream release before TuxCare onboarded version 6.14.2. The fix modifies lib/parse.js to pass arrayLimit to utils.combine() for bracket notation (lines 182-195) and introduces overflow tracking..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.14.2",
          "identifiers": {
            "purl": "pkg:npm/qs@6.14.2"
          }
        }
      ],
      "timestamp": "2026-10-31T13:14:17.835111+00:00",
      "status_notes": "Vulnerability CVE-2026-110816 affects version 6.14.2 of qs, and is fixed in 6.14.2-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-110816"
      },
      "action_statement": "Vulnerability CVE-2026-110816 affects version 6.14.2 of qs, and is fixed in 6.14.2-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.14.2",
          "identifiers": {
            "purl": "pkg:npm/qs@6.14.2"
          }
        }
      ],
      "timestamp": "2026-10-27T07:05:00.167026+00:00",
      "status_notes": "Vulnerability CVE-2026-110910 affects version 6.14.2 of qs.",
      "vulnerability": {
        "name": "CVE-2026-110910"
      },
      "action_statement": "Vulnerability CVE-2026-110910 affects version 6.14.2 of qs."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.14.2",
          "identifiers": {
            "purl": "pkg:npm/qs@6.14.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:35:29.309896+00:00",
      "status_notes": "Vulnerability CVE-2026-2391 does not affect version 6.14.2 of qs. not_affected \u2014 CVE-2026-2391 fix is already present in the target at lib/parse.js lines 144-149. The fix was authored by Jordan Harband (ljharb@gmail.com) and shipped in the upstream v6.14.2 release, before TuxCare began work on this branch. The fix validates comma-parsed array lengths and either throws an error or converts oversized arrays to objects via utils.combine(), preventing the memory exhaustion atta...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-2391"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-2391 fix is already present in the target at lib/parse.js lines 144-149. The fix was authored by Jordan Harband (ljharb@gmail.com) and shipped in the upstream v6.14.2 release, before TuxCare began work on this branch. The fix validates comma-parsed array lengths and either throws an error or converts oversized arrays to objects via utils.combine(), preventing the memory exhaustion atta..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.14.2",
          "identifiers": {
            "purl": "pkg:npm/qs@6.14.2"
          }
        }
      ],
      "timestamp": "2026-10-19T22:43:00.612587+00:00",
      "status_notes": "Vulnerability CVE-2026-82417 affects version 6.14.2 of qs, and is fixed in 6.14.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-82417"
      },
      "action_statement": "Vulnerability CVE-2026-82417 affects version 6.14.2 of qs, and is fixed in 6.14.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.14.2",
          "identifiers": {
            "purl": "pkg:npm/qs@6.14.2"
          }
        }
      ],
      "timestamp": "2026-10-19T22:43:00.612587+00:00",
      "status_notes": "Vulnerability CVE-2026-82562 affects version 6.14.2 of qs, and is fixed in 6.14.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-82562"
      },
      "action_statement": "Vulnerability CVE-2026-82562 affects version 6.14.2 of qs, and is fixed in 6.14.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.14.2",
          "identifiers": {
            "purl": "pkg:npm/qs@6.14.2"
          }
        }
      ],
      "timestamp": "2026-10-19T22:43:00.612587+00:00",
      "status_notes": "Vulnerability CVE-2026-8723 affects version 6.14.2 of qs, and is fixed in 6.14.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-8723"
      },
      "action_statement": "Vulnerability CVE-2026-8723 affects version 6.14.2 of qs, and is fixed in 6.14.2-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.14.2",
          "identifiers": {
            "purl": "pkg:npm/qs@6.14.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability GHSA-crvj-3gj9-gm2p is a false positive for qs 6.14.2.",
      "vulnerability": {
        "name": "GHSA-crvj-3gj9-gm2p"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}