qs

Security advisories6

• qs: qs: Denial of Service via Attacker Controlled isBufferfixed in 6.16.0
• qs: qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)fixed in 6.16.1
• qs: qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustionfixed in 6.14.1
• qs: qs vulnerable to Prototype Pollutionfixed in 6.10.3, 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, 6.2.4
• qs: qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is setfixed in 6.15.2
• qs: qs's arrayLimit bypass in comma parsing allows denial of servicefixed in 6.14.2

Versions that change something