{
  "@id": "urn:uuid:3ce8c589-cb3e-41ed-9d12-4df56fce7e81",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T15:37:21.976714+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.3",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2014-10064 affects version 6.15.3 of qs.",
      "vulnerability": {
        "name": "CVE-2014-10064"
      },
      "action_statement": "Vulnerability CVE-2014-10064 affects version 6.15.3 of qs."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.3",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:13:02.714408+00:00",
      "status_notes": "Vulnerability CVE-2014-7191 does not affect version 6.15.3 of qs. not_affected \u2014 The target repository (qs 6.15.3-tuxcare.4) is not affected by CVE-2014-7191. All defenses against the sparse array memory exhaustion vulnerability are present in the codebase: arrayLimit default of 20, parameterLimit default of 1000, array index validation, and array compaction. These fixes were introduced by the upstream vendor (Nathan LaFreniere) in version 1.0 and are maintained in version ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-7191"
      },
      "impact_statement": "not_affected \u2014 The target repository (qs 6.15.3-tuxcare.4) is not affected by CVE-2014-7191. All defenses against the sparse array memory exhaustion vulnerability are present in the codebase: arrayLimit default of 20, parameterLimit default of 1000, array index validation, and array compaction. These fixes were introduced by the upstream vendor (Nathan LaFreniere) in version 1.0 and are maintained in version ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.3",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2017-1000048 affects version 6.15.3 of qs.",
      "vulnerability": {
        "name": "CVE-2017-1000048"
      },
      "action_statement": "Vulnerability CVE-2017-1000048 affects version 6.15.3 of qs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.3",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2022-24999 affects version 6.15.3 of qs.",
      "vulnerability": {
        "name": "CVE-2022-24999"
      },
      "action_statement": "Vulnerability CVE-2022-24999 affects version 6.15.3 of qs."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.3",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:32:29.747187+00:00",
      "status_notes": "Vulnerability CVE-2025-15284 does not affect version 6.15.3 of qs. not_affected \u2014 CVE-2025-15284 describes a consistency bug where `arrayLimit` was not enforced for bracket notation (`a[]=1&a[]=2`), only for indexed notation. The target repository (qs 6.15.3-tuxcare.4) is NOT affected because upstream maintainer Jordan Harband fixed this issue in commit 74a0f6a on June 23, 2026, which shipped in upstream v6.15.3 before TuxCare onboarded the release. The vulnerable pattern is...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-15284"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-15284 describes a consistency bug where `arrayLimit` was not enforced for bracket notation (`a[]=1&a[]=2`), only for indexed notation. The target repository (qs 6.15.3-tuxcare.4) is NOT affected because upstream maintainer Jordan Harband fixed this issue in commit 74a0f6a on June 23, 2026, which shipped in upstream v6.15.3 before TuxCare onboarded the release. The vulnerable pattern is..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.3",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.3"
          }
        }
      ],
      "timestamp": "2026-10-16T08:27:00.090163+00:00",
      "status_notes": "Vulnerability CVE-2026-110816 affects version 6.15.3 of qs, and is fixed in 6.15.3-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-110816"
      },
      "action_statement": "Vulnerability CVE-2026-110816 affects version 6.15.3 of qs, and is fixed in 6.15.3-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.3",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.3"
          }
        }
      ],
      "timestamp": "2026-10-28T09:48:17.847708+00:00",
      "status_notes": "Vulnerability CVE-2026-110910 affects version 6.15.3 of qs, and is fixed in 6.15.3-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-110910"
      },
      "action_statement": "Vulnerability CVE-2026-110910 affects version 6.15.3 of qs, and is fixed in 6.15.3-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.3",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:37:21.976714+00:00",
      "status_notes": "Vulnerability CVE-2026-2391 does not affect version 6.15.3 of qs. not_affected \u2014 The target repository (qs version 6.15.3-tuxcare.4 at commit 7beb988b5203b0f3b6751e5080a12607cb6c0df4) is NOT vulnerable to CVE-2026-2391. The vulnerability describes a bypass of the `arrayLimit` option when parsing comma-separated values with `comma: true`, allowing memory exhaustion via arbitrarily large arrays. The fix for this vulnerability (commit f6a7abff1f13d644db9b05fe4f2c98ada6bf8482 b...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-2391"
      },
      "impact_statement": "not_affected \u2014 The target repository (qs version 6.15.3-tuxcare.4 at commit 7beb988b5203b0f3b6751e5080a12607cb6c0df4) is NOT vulnerable to CVE-2026-2391. The vulnerability describes a bypass of the `arrayLimit` option when parsing comma-separated values with `comma: true`, allowing memory exhaustion via arbitrarily large arrays. The fix for this vulnerability (commit f6a7abff1f13d644db9b05fe4f2c98ada6bf8482 b..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.3",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.3"
          }
        }
      ],
      "timestamp": "2026-09-27T20:46:00.087433+00:00",
      "status_notes": "Vulnerability CVE-2026-82417 affects version 6.15.3 of qs, and is fixed in 6.15.3-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-82417"
      },
      "action_statement": "Vulnerability CVE-2026-82417 affects version 6.15.3 of qs, and is fixed in 6.15.3-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.3",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.3"
          }
        }
      ],
      "timestamp": "2026-09-27T20:46:00.087433+00:00",
      "status_notes": "Vulnerability CVE-2026-82562 affects version 6.15.3 of qs, and is fixed in 6.15.3-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-82562"
      },
      "action_statement": "Vulnerability CVE-2026-82562 affects version 6.15.3 of qs, and is fixed in 6.15.3-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.3",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:57:07.115751+00:00",
      "status_notes": "Vulnerability CVE-2026-8723 does not affect version 6.15.3 of qs. not_affected \u2014 CVE-2026-8723: The target repository (qs 6.15.3-tuxcare.4) is NOT AFFECTED. The vulnerability pattern is not present because the upstream fix was already included in the upstream v6.15.3 release before TuxCare began maintaining this version. The fix at lib/stringify.js:145-147 guards null/undefined array elements before passing them to the encoder, preventing the TypeError that would occur when...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-8723"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-8723: The target repository (qs 6.15.3-tuxcare.4) is NOT AFFECTED. The vulnerability pattern is not present because the upstream fix was already included in the upstream v6.15.3 release before TuxCare began maintaining this version. The fix at lib/stringify.js:145-147 guards null/undefined array elements before passing them to the encoder, preventing the TypeError that would occur when..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.15.3",
          "identifiers": {
            "purl": "pkg:npm/qs@6.15.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability GHSA-crvj-3gj9-gm2p is a false positive for qs 6.15.3.",
      "vulnerability": {
        "name": "GHSA-crvj-3gj9-gm2p"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}