Qs Project vulnerabilities
We track 2 vulnerabilities in Qs Project products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on February 12, 2026.
2vulnerabilities
0critical
2high
0exploited
7.5average CVSS score
Latest Qs Project vulnerabilities
- 7.5 High severity
### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values…
### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bra
- 7.5 High severity
Qs: Improperly Controlled Modification of Object Prototype Attributes
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can pla