{
  "@id": "urn:uuid:33730d5a-ee91-4800-8568-8d63b47dea4d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T13:36:21.720801+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.7.0",
          "identifiers": {
            "purl": "pkg:npm/qs@6.7.0"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2014-10064 affects version 6.7.0 of qs.",
      "vulnerability": {
        "name": "CVE-2014-10064"
      },
      "action_statement": "Vulnerability CVE-2014-10064 affects version 6.7.0 of qs."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.7.0",
          "identifiers": {
            "purl": "pkg:npm/qs@6.7.0"
          }
        }
      ],
      "timestamp": "2026-11-03T15:13:02.714408+00:00",
      "status_notes": "Vulnerability CVE-2014-7191 does not affect version 6.7.0 of qs. not_affected \u2014 The target repository (qs version 6.7.0-tuxcare.4) is NOT affected by CVE-2014-7191. This vulnerability affects qs versions prior to 1.0.0 and involves denial of service through memory exhaustion by parsing crafted query strings that create very large sparse arrays. The target version contains all three protective measures introduced in upstream version 1.0.0: (1) array index limit (arrayLimit:...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-7191"
      },
      "impact_statement": "not_affected \u2014 The target repository (qs version 6.7.0-tuxcare.4) is NOT affected by CVE-2014-7191. This vulnerability affects qs versions prior to 1.0.0 and involves denial of service through memory exhaustion by parsing crafted query strings that create very large sparse arrays. The target version contains all three protective measures introduced in upstream version 1.0.0: (1) array index limit (arrayLimit:..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.7.0",
          "identifiers": {
            "purl": "pkg:npm/qs@6.7.0"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2017-1000048 affects version 6.7.0 of qs.",
      "vulnerability": {
        "name": "CVE-2017-1000048"
      },
      "action_statement": "Vulnerability CVE-2017-1000048 affects version 6.7.0 of qs."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.7.0",
          "identifiers": {
            "purl": "pkg:npm/qs@6.7.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-24999 affects version 6.7.0 of qs, and is fixed in 6.7.0-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2022-24999"
      },
      "action_statement": "Vulnerability CVE-2022-24999 affects version 6.7.0 of qs, and is fixed in 6.7.0-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.7.0",
          "identifiers": {
            "purl": "pkg:npm/qs@6.7.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-15284 affects version 6.7.0 of qs, and is fixed in 6.7.0-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2025-15284"
      },
      "action_statement": "Vulnerability CVE-2025-15284 affects version 6.7.0 of qs, and is fixed in 6.7.0-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.7.0",
          "identifiers": {
            "purl": "pkg:npm/qs@6.7.0"
          }
        }
      ],
      "timestamp": "2026-10-31T13:05:31.317826+00:00",
      "status_notes": "Vulnerability CVE-2026-110816 affects version 6.7.0 of qs, and is fixed in 6.7.0-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-110816"
      },
      "action_statement": "Vulnerability CVE-2026-110816 affects version 6.7.0 of qs, and is fixed in 6.7.0-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.7.0",
          "identifiers": {
            "purl": "pkg:npm/qs@6.7.0"
          }
        }
      ],
      "timestamp": "2026-11-06T13:36:21.720801+00:00",
      "status_notes": "Vulnerability CVE-2026-110910 does not affect version 6.7.0 of qs. not_affected \u2014 qs 6.7.0-tuxcare.4 is not affected. The allowEmptyArrays option, introduced in qs 6.12.0, does not exist in this version. Empty arrays are never serialized, so no unencoded key is emitted. Every key that does get emitted goes through encoder and formatter.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-110910"
      },
      "impact_statement": "not_affected \u2014 qs 6.7.0-tuxcare.4 is not affected. The allowEmptyArrays option, introduced in qs 6.12.0, does not exist in this version. Empty arrays are never serialized, so no unencoded key is emitted. Every key that does get emitted goes through encoder and formatter."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.7.0",
          "identifiers": {
            "purl": "pkg:npm/qs@6.7.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-2391 affects version 6.7.0 of qs, and is fixed in 6.7.0-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-2391"
      },
      "action_statement": "Vulnerability CVE-2026-2391 affects version 6.7.0 of qs, and is fixed in 6.7.0-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.7.0",
          "identifiers": {
            "purl": "pkg:npm/qs@6.7.0"
          }
        }
      ],
      "timestamp": "2026-10-07T10:48:00.634805+00:00",
      "status_notes": "Vulnerability CVE-2026-82417 affects version 6.7.0 of qs, and is fixed in 6.7.0-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-82417"
      },
      "action_statement": "Vulnerability CVE-2026-82417 affects version 6.7.0 of qs, and is fixed in 6.7.0-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.7.0",
          "identifiers": {
            "purl": "pkg:npm/qs@6.7.0"
          }
        }
      ],
      "timestamp": "2026-10-07T12:02:00.089721+00:00",
      "status_notes": "Vulnerability CVE-2026-82562 does not affect version 6.7.0 of qs. not_affected \u2014 Version 6.7.0 is not affected by CVE-2026-82562. The target has a runtime defense at lib/parse.js:92-97 that enforces arrayLimit for ALL comma-separated values, including bracket-key forms like `a[]=`, before any bracket notation processing occurs. Direct testing confirms that `a[]=1,2,3,4` with `arrayLimit: 3` correctly throws RangeError when `throwOnLimitExceeded: true`, and properly limits a...",
      "vulnerability": {
        "name": "CVE-2026-82562"
      },
      "impact_statement": "not_affected \u2014 Version 6.7.0 is not affected by CVE-2026-82562. The target has a runtime defense at lib/parse.js:92-97 that enforces arrayLimit for ALL comma-separated values, including bracket-key forms like `a[]=`, before any bracket notation processing occurs. Direct testing confirms that `a[]=1,2,3,4` with `arrayLimit: 3` correctly throws RangeError when `throwOnLimitExceeded: true`, and properly limits a..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.7.0",
          "identifiers": {
            "purl": "pkg:npm/qs@6.7.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-8723 does not affect version 6.7.0 of qs. not_affected \u2014 Version 6.7.0 is NOT affected by CVE-2026-8723. The vulnerable code path that causes TypeError when stringifying arrays with null/undefined elements under arrayFormat='comma' + encodeValuesOnly=true does not exist in this version. The target uses a different, safe implementation that joins array elements before encoding.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-8723"
      },
      "impact_statement": "not_affected \u2014 Version 6.7.0 is NOT affected by CVE-2026-8723. The vulnerable code path that causes TypeError when stringifying arrays with null/undefined elements under arrayFormat='comma' + encodeValuesOnly=true does not exist in this version. The target uses a different, safe implementation that joins array elements before encoding."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/qs@6.7.0",
          "identifiers": {
            "purl": "pkg:npm/qs@6.7.0"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability GHSA-crvj-3gj9-gm2p is a false positive for qs 6.7.0.",
      "vulnerability": {
        "name": "GHSA-crvj-3gj9-gm2p"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}