{
  "@id": "urn:uuid:761010f7-9f4a-4a5b-8557-8fc5274873e4",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T13:37:00.055768+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.5.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.5.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2014-10064 affects version 6.5.1 of qs.",
      "vulnerability": {
        "name": "CVE-2014-10064"
      },
      "action_statement": "Vulnerability CVE-2014-10064 affects version 6.5.1 of qs."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.5.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.5.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:13:02.714408+00:00",
      "status_notes": "Vulnerability CVE-2014-7191 does not affect version 6.5.1 of qs. not_affected \u2014 CVE-2014-7191 (sparse array memory exhaustion) is not present in target version 6.5.1-tuxcare.2. The vulnerability affects qs versions < 1.0.0 and was fixed by the upstream vendor in 2014. The target is based on upstream v6.5.1 (2017) which already contains all required defenses: arrayLimit=20, parameterLimit=1000, and compact() function. These fixes were shipped in the upstream release (commit...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-7191"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-7191 (sparse array memory exhaustion) is not present in target version 6.5.1-tuxcare.2. The vulnerability affects qs versions < 1.0.0 and was fixed by the upstream vendor in 2014. The target is based on upstream v6.5.1 (2017) which already contains all required defenses: arrayLimit=20, parameterLimit=1000, and compact() function. These fixes were shipped in the upstream release (commit..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.5.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.5.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2017-1000048 affects version 6.5.1 of qs.",
      "vulnerability": {
        "name": "CVE-2017-1000048"
      },
      "action_statement": "Vulnerability CVE-2017-1000048 affects version 6.5.1 of qs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.5.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.5.1"
          }
        }
      ],
      "timestamp": "2026-10-19T22:02:00.092009+00:00",
      "status_notes": "Vulnerability CVE-2022-24999 affects version 6.5.1 of qs, and is fixed in 6.5.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2022-24999"
      },
      "action_statement": "Vulnerability CVE-2022-24999 affects version 6.5.1 of qs, and is fixed in 6.5.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.5.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.5.1"
          }
        }
      ],
      "timestamp": "2026-10-19T22:02:00.092009+00:00",
      "status_notes": "Vulnerability CVE-2025-15284 affects version 6.5.1 of qs, and is fixed in 6.5.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2025-15284"
      },
      "action_statement": "Vulnerability CVE-2025-15284 affects version 6.5.1 of qs, and is fixed in 6.5.1-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.5.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.5.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:02:41.455639+00:00",
      "status_notes": "Vulnerability CVE-2026-110816 does not affect version 6.5.1 of qs. not_affected \u2014 Version 6.5.1-tuxcare.2 is not affected by CVE-2026-110816. The vulnerable `arrayFormat: 'comma'` feature that triggers unsafe string coercion via `obj.join(',')` does not exist in this version. The CVE explicitly states the affected range is >= 6.7.0, <= 6.16.0, where the comma array format was introduced. Version 6.5.1 predates this feature and only supports three arrayFormat options: bracket...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-110816"
      },
      "impact_statement": "not_affected \u2014 Version 6.5.1-tuxcare.2 is not affected by CVE-2026-110816. The vulnerable `arrayFormat: 'comma'` feature that triggers unsafe string coercion via `obj.join(',')` does not exist in this version. The CVE explicitly states the affected range is >= 6.7.0, <= 6.16.0, where the comma array format was introduced. Version 6.5.1 predates this feature and only supports three arrayFormat options: bracket..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.5.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.5.1"
          }
        }
      ],
      "timestamp": "2026-11-06T13:37:00.055768+00:00",
      "status_notes": "Vulnerability CVE-2026-110910 does not affect version 6.5.1 of qs. not_affected \u2014 qs 6.5.1-tuxcare.2 predates the allowEmptyArrays option, which first shipped in v6.12.0. The vulnerable early return that emits an unencoded key for an empty array does not exist. In this version an empty array contributes nothing to the output, so no key text can be injected.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-110910"
      },
      "impact_statement": "not_affected \u2014 qs 6.5.1-tuxcare.2 predates the allowEmptyArrays option, which first shipped in v6.12.0. The vulnerable early return that emits an unencoded key for an empty array does not exist. In this version an empty array contributes nothing to the output, so no key text can be injected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.5.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.5.1"
          }
        }
      ],
      "timestamp": "2026-10-07T12:18:00.117428+00:00",
      "status_notes": "Vulnerability CVE-2026-2391 does not affect version 6.5.1 of qs. not_affected \u2014 Version 6.5.1 is not affected by CVE-2026-2391. The vulnerability requires the `comma` option feature to be present, which allows parsing comma-separated values as arrays (e.g., `?param=a,b,c`). This feature was introduced in version 6.7.0 (commit b84acbab2c, September 2018). Version 6.5.1 predates this feature entirely\u2014no comma-handling code exists in lib/parse.js or anywhere in the codebase. ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-2391"
      },
      "impact_statement": "not_affected \u2014 Version 6.5.1 is not affected by CVE-2026-2391. The vulnerability requires the `comma` option feature to be present, which allows parsing comma-separated values as arrays (e.g., `?param=a,b,c`). This feature was introduced in version 6.7.0 (commit b84acbab2c, September 2018). Version 6.5.1 predates this feature entirely\u2014no comma-handling code exists in lib/parse.js or anywhere in the codebase. ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.5.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.5.1"
          }
        }
      ],
      "timestamp": "2026-10-19T22:02:00.092009+00:00",
      "status_notes": "Vulnerability CVE-2026-82417 affects version 6.5.1 of qs, and is fixed in 6.5.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-82417"
      },
      "action_statement": "Vulnerability CVE-2026-82417 affects version 6.5.1 of qs, and is fixed in 6.5.1-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.5.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.5.1"
          }
        }
      ],
      "timestamp": "2026-10-07T12:04:00.119409+00:00",
      "status_notes": "Vulnerability CVE-2026-82562 does not affect version 6.5.1 of qs. not_affected \u2014 Version 6.5.1 is NOT AFFECTED by CVE-2026-82562. The vulnerability requires the comma-parsing feature (`comma: true` option and `parseArrayValue` function) which was not introduced until v6.7.0. Target version 6.5.1 predates this feature entirely. The vulnerable code pattern\u2014specifically the `isFlatArrayValue` parameter that allowed bracket-key forms like `a[]=1,2,3,4` to bypass arrayLimit enfo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-82562"
      },
      "impact_statement": "not_affected \u2014 Version 6.5.1 is NOT AFFECTED by CVE-2026-82562. The vulnerability requires the comma-parsing feature (`comma: true` option and `parseArrayValue` function) which was not introduced until v6.7.0. Target version 6.5.1 predates this feature entirely. The vulnerable code pattern\u2014specifically the `isFlatArrayValue` parameter that allowed bracket-key forms like `a[]=1,2,3,4` to bypass arrayLimit enfo..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.5.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.5.1"
          }
        }
      ],
      "timestamp": "2026-10-07T12:22:00.082189+00:00",
      "status_notes": "Vulnerability CVE-2026-8723 does not affect version 6.5.1 of qs. not_affected \u2014 Target version 6.5.1 predates the vulnerable code introduction. The CVE-2026-8723 vulnerability was introduced in v6.11.1 when the `arrayFormat: 'comma'` feature was added (commit 4c4b23d, PR #463, 2023-01-19). Version 6.5.1 does not implement this feature at all - the arrayPrefixGenerators only support 'brackets', 'indices', and 'repeat' formats. The vulnerable code path (comma + encodeValuesO...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-8723"
      },
      "impact_statement": "not_affected \u2014 Target version 6.5.1 predates the vulnerable code introduction. The CVE-2026-8723 vulnerability was introduced in v6.11.1 when the `arrayFormat: 'comma'` feature was added (commit 4c4b23d, PR #463, 2023-01-19). Version 6.5.1 does not implement this feature at all - the arrayPrefixGenerators only support 'brackets', 'indices', and 'repeat' formats. The vulnerable code path (comma + encodeValuesO..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.5.1",
          "identifiers": {
            "purl": "pkg:npm/qs@6.5.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability GHSA-crvj-3gj9-gm2p is a false positive for qs 6.5.1.",
      "vulnerability": {
        "name": "GHSA-crvj-3gj9-gm2p"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}