An open index of dependabot pull requests across open source projects.

qs

Ecosystem:
npm
Package URL:
pkg:npm/qs
Total PRs:
22,129 Dependabot PRs
Latest PR:
3 days ago
Unique Repositories:
18,815 repositories
Unique Repos (30 days):
48 repositories
Security Advisories
qs vulnerable to Prototype Pollution
GHSA-hrpp-h998-j3pp CVE-2022-24999 HIGH published over 3 years ago • updated 1 day ago
qs before 6.10.3 allows attackers to cause a Node process hang because an `__ proto__` key can be used. In many typical web framework use cases, an...
qs's arrayLimit bypass in comma parsing allows denial of service
GHSA-w7fw-mjwx-w883 CVE-2026-2391 LOW published 5 months ago • updated 26 days ago
### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to c...
Prototype Pollution Protection Bypass in qs
GHSA-gqgv-6jq5-jjj9 CVE-2017-1000048 HIGH published about 6 years ago • updated about 7 hours ago
Affected version of `qs` are vulnerable to Prototype Pollution because it is possible to bypass the protection. The `qs.parse` function fails to pr...
Denial-of-Service Extended Event Loop Blocking in qs
GHSA-f9cm-p3w6-xvr3 CVE-2014-10064 HIGH published almost 8 years ago • updated about 7 hours ago
Versions prior to 1.0.0 of `qs` are affected by a denial of service vulnerability that results from excessive recursion in parsing a deeply nested ...
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set
GHSA-q8mj-m7cp-5q26 CVE-2026-8723 MODERATE published about 2 months ago • updated 27 days ago
### Summary `qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` o...
Recent PRs
Package Details
Name: qs
Ecosystem: npm
PURL Type: npm
Package URL: pkg:npm/qs
JSON API: View JSON
Security Advisories

7

Active advisories
HIGH 4
MODERATE 2
LOW 1
View All npm Advisories
Package Information
Description:

A querystring parser that supports nesting and arrays, with a depth limit

Repository: https://github.com/ljharb/qs
Homepage: https://github.com/ljharb/qs
Latest Release: 6.14.0
over 1 year ago
Dependent Repos: 2,110,964
Dependent Packages: 15,944
Downloads: 399,573,108
Ranking: Top 0.0137% by dependent repos Top 0.0019% by downloads Top 0.0064% by dependent pkgs
PR Status
Open 6,466 (29.2%)
Merged 322 (1.5%)
Closed 15,058 (68.0%)
PR Types
Major 52 (0.2%)
Minor 13,465 (60.8%)
Patch 8,217 (37.1%)
Removal 75 (0.3%)