{
  "@id": "urn:uuid:078b3bde-efda-42f2-8e84-2afc39fea530",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 12,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T13:37:00.055768+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.2.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.2.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2014-10064 affects version 6.2.1 of qs.",
      "vulnerability": {
        "name": "CVE-2014-10064"
      },
      "action_statement": "Vulnerability CVE-2014-10064 affects version 6.2.1 of qs."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.2.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.2.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:13:50.465041+00:00",
      "status_notes": "Vulnerability CVE-2014-7191 does not affect version 6.2.1 of qs. not_affected \u2014 CVE-2014-7191 (sparse array DoS) is not present in qs@6.2.1-tuxcare.1. All three vendor-provided defenses (arrayLimit: 20, parameterLimit: 1000, compact() function) were already present in the upstream release 6.2.1 that TuxCare onboarded. The fixes were authored by Nathan LaFreniere (quitlahok@gmail.com) in commits 4667c41c (arrayLimit), 0f3c540 (refactor), and bb10408f (parameterLimit) betwee...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-7191"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-7191 (sparse array DoS) is not present in qs@6.2.1-tuxcare.1. All three vendor-provided defenses (arrayLimit: 20, parameterLimit: 1000, compact() function) were already present in the upstream release 6.2.1 that TuxCare onboarded. The fixes were authored by Nathan LaFreniere (quitlahok@gmail.com) in commits 4667c41c (arrayLimit), 0f3c540 (refactor), and bb10408f (parameterLimit) betwee..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.2.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.2.1"
          }
        }
      ],
      "timestamp": "2026-10-20T06:04:00.091494+00:00",
      "status_notes": "Vulnerability CVE-2017-1000048 affects version 6.2.1 of qs, and is fixed in 6.2.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2017-1000048"
      },
      "action_statement": "Vulnerability CVE-2017-1000048 affects version 6.2.1 of qs, and is fixed in 6.2.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.2.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.2.1"
          }
        }
      ],
      "timestamp": "2026-10-20T06:04:00.091494+00:00",
      "status_notes": "Vulnerability CVE-2022-24999 affects version 6.2.1 of qs, and is fixed in 6.2.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2022-24999"
      },
      "action_statement": "Vulnerability CVE-2022-24999 affects version 6.2.1 of qs, and is fixed in 6.2.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.2.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.2.1"
          }
        }
      ],
      "timestamp": "2026-10-20T06:04:00.091494+00:00",
      "status_notes": "Vulnerability CVE-2025-15284 affects version 6.2.1 of qs, and is fixed in 6.2.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2025-15284"
      },
      "action_statement": "Vulnerability CVE-2025-15284 affects version 6.2.1 of qs, and is fixed in 6.2.1-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.2.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.2.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:03:12.180165+00:00",
      "status_notes": "Vulnerability CVE-2026-110816 does not affect version 6.2.1 of qs. not_affected \u2014 Target version 6.2.1-tuxcare.1 predates the vulnerable feature. CVE-2026-110816 affects qs versions >= 6.7.0 through a crash in `arrayFormat: 'comma'` when array elements have non-callable `toString` properties. The comma arrayFormat option was introduced 148 commits after v6.2.1 (commit b84acba, first released in v6.7.0). Version 6.2.1 only supports arrayFormat values 'brackets', 'indices', an...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-110816"
      },
      "impact_statement": "not_affected \u2014 Target version 6.2.1-tuxcare.1 predates the vulnerable feature. CVE-2026-110816 affects qs versions >= 6.7.0 through a crash in `arrayFormat: 'comma'` when array elements have non-callable `toString` properties. The comma arrayFormat option was introduced 148 commits after v6.2.1 (commit b84acba, first released in v6.7.0). Version 6.2.1 only supports arrayFormat values 'brackets', 'indices', an..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.2.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.2.1"
          }
        }
      ],
      "timestamp": "2026-11-06T13:37:00.055768+00:00",
      "status_notes": "Vulnerability CVE-2026-110910 does not affect version 6.2.1 of qs. not_affected \u2014 qs 6.2.1-tuxcare.1 does not have the `allowEmptyArrays` option or the early-return branch that CVE-2026-110910 exploits. That option first shipped in v6.12.0. In this version an empty array produces no output, and every emitted key goes through the encoder, so a key with a reserved character cannot reach the output unencoded.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-110910"
      },
      "impact_statement": "not_affected \u2014 qs 6.2.1-tuxcare.1 does not have the `allowEmptyArrays` option or the early-return branch that CVE-2026-110910 exploits. That option first shipped in v6.12.0. In this version an empty array produces no output, and every emitted key goes through the encoder, so a key with a reserved character cannot reach the output unencoded."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.2.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.2.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:34:19.282169+00:00",
      "status_notes": "Vulnerability CVE-2026-2391 does not affect version 6.2.1 of qs. not_affected \u2014 CVE-2026-2391 does not affect qs version 6.2.1. The vulnerability requires the `comma: true` option to parse comma-separated query parameter values (e.g., `?param=a,b,c`). This feature was introduced in version 6.7.0 (commit b84acba), which is 5 minor versions after the target version 6.2.1. Since the target does not receive or process comma-separated values at all, the arrayLimit bypass vulner...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-2391"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-2391 does not affect qs version 6.2.1. The vulnerability requires the `comma: true` option to parse comma-separated query parameter values (e.g., `?param=a,b,c`). This feature was introduced in version 6.7.0 (commit b84acba), which is 5 minor versions after the target version 6.2.1. Since the target does not receive or process comma-separated values at all, the arrayLimit bypass vulner..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.2.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.2.1"
          }
        }
      ],
      "timestamp": "2026-10-20T06:04:00.091494+00:00",
      "status_notes": "Vulnerability CVE-2026-82417 affects version 6.2.1 of qs, and is fixed in 6.2.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-82417"
      },
      "action_statement": "Vulnerability CVE-2026-82417 affects version 6.2.1 of qs, and is fixed in 6.2.1-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.2.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.2.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:42:13.542842+00:00",
      "status_notes": "Vulnerability CVE-2026-82562 does not affect version 6.2.1 of qs. not_affected \u2014 Version 6.2.1 is not affected by CVE-2026-82562. The vulnerability requires the `comma: true` option which enables comma-splitting of individual query parameter values. This feature does not exist in version 6.2.1. The vulnerable `parseArrayValue` function and `throwOnLimitExceeded` option were introduced in later versions (present in v6.15.3 where the CVE was tested, absent in v6.2.1). Empiric...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-82562"
      },
      "impact_statement": "not_affected \u2014 Version 6.2.1 is not affected by CVE-2026-82562. The vulnerability requires the `comma: true` option which enables comma-splitting of individual query parameter values. This feature does not exist in version 6.2.1. The vulnerable `parseArrayValue` function and `throwOnLimitExceeded` option were introduced in later versions (present in v6.15.3 where the CVE was tested, absent in v6.2.1). Empiric..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.2.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.2.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:58:37.746578+00:00",
      "status_notes": "Vulnerability CVE-2026-8723 does not affect version 6.2.1 of qs. not_affected \u2014 CVE-2026-8723 affects qs >=6.11.1 where arrayFormat 'comma' with encodeValuesOnly true triggers TypeError on null/undefined array elements via unguarded utils.maybeMap(obj, encoder) call. Target version 6.2.1 predates the vulnerable code introduction entirely. The comma arrayFormat option, maybeMap utility, and vulnerable code path do not exist in this version. The CVE explicitly states the vul...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-8723"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-8723 affects qs >=6.11.1 where arrayFormat 'comma' with encodeValuesOnly true triggers TypeError on null/undefined array elements via unguarded utils.maybeMap(obj, encoder) call. Target version 6.2.1 predates the vulnerable code introduction entirely. The comma arrayFormat option, maybeMap utility, and vulnerable code path do not exist in this version. The CVE explicitly states the vul..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.2.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.2.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability GHSA-crvj-3gj9-gm2p is a false positive for qs 6.2.1.",
      "vulnerability": {
        "name": "GHSA-crvj-3gj9-gm2p"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}