An open index of dependabot pull requests across open source projects.

qs

Ecosystem:
npm
Package URL:
pkg:npm/qs
Total PRs:
21,844 Dependabot PRs
Latest PR:
about 3 hours ago
Unique Repositories:
18,604 repositories
Unique Repos (30 days):
672 repositories
Security Advisories
qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion
GHSA-6rw7-vpxm-498p CVE-2025-15284 MODERATE published 5 months ago • updated about 21 hours ago
### Summary The `arrayLimit` option in qs did not enforce limits for bracket notation (`a[]=1&a[]=2`), only for indexed notation (`a[0]=1`). This ...
qs's arrayLimit bypass in comma parsing allows denial of service
GHSA-w7fw-mjwx-w883 CVE-2026-2391 LOW published 4 months ago • updated 13 days ago
### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to c...
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set
GHSA-q8mj-m7cp-5q26 CVE-2026-8723 MODERATE published 10 days ago • updated 10 days ago
### Summary `qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` o...
Denial-of-Service Memory Exhaustion in qs
GHSA-jjv7-qpx3-h62q CVE-2014-7191 HIGH published over 8 years ago • updated about 2 hours ago
Versions prior to 1.0 of `qs` are affected by a denial of service condition. This condition is triggered by parsing a crafted string that deseriali...
Denial-of-Service Extended Event Loop Blocking in qs
GHSA-f9cm-p3w6-xvr3 CVE-2014-10064 HIGH published over 7 years ago • updated about 2 hours ago
Versions prior to 1.0.0 of `qs` are affected by a denial of service vulnerability that results from excessive recursion in parsing a deeply nested ...
Recent PRs (filtered by: Patch PRs )
Package Details
Name: qs
Ecosystem: npm
PURL Type: npm
Package URL: pkg:npm/qs
JSON API: View JSON
Security Advisories

7

Active advisories
HIGH 4
MODERATE 2
LOW 1
View All npm Advisories
Package Information
Description:

A querystring parser that supports nesting and arrays, with a depth limit

Repository: https://github.com/ljharb/qs
Homepage: https://github.com/ljharb/qs
Latest Release: 6.14.0
over 1 year ago
Dependent Repos: 2,110,964
Dependent Packages: 15,944
Downloads: 399,573,108
Ranking: Top 0.0137% by dependent repos Top 0.0019% by downloads Top 0.0064% by dependent pkgs
PR Status
Open 6,358 (29.1%)
Merged 322 (1.5%)
Closed 14,877 (68.1%)
PR Types
Major 52 (0.2%)
Minor 13,320 (61.0%)
Patch 8,074 (37.0%)
Removal 75 (0.3%)