Repository navigation
Security: ljharb/qs
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)GHSA-6pq8-jhm2-2vcw published
Oct 14, 2026 by ljharbModerate -
qs array-limit bypass via bracket-key comma parsingGHSA-x5fp-wj9c-mxmx published
Aug 29, 2026 by ljharbLow -
Denial of Service via Attacker Controlled isBufferGHSA-4mjr-xmp4-gh2g published
Aug 29, 2026 by ljharbModerate -
remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is setGHSA-q8mj-m7cp-5q26 published
May 16, 2026 by ljharbModerate -
qs's arrayLimit bypass in comma parsing allows denial of serviceGHSA-w7fw-mjwx-w883 published
Feb 12, 2026 by ljharbLow -
arrayLimit bypass in bracket notation allows DoS via memory exhaustionGHSA-6rw7-vpxm-498p published
Dec 29, 2025 by ljharbLow