Qs vulnerabilities

2 known vulnerabilities in Qs from Qs Project. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values…

  CVE-2026-2391Feb 12, 2026Qs Project

  ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bra

• 7.5 High severity

  Qs: Improperly Controlled Modification of Object Prototype Attributes

  CVE-2022-24999Nov 26, 2022Qs ProjectEPSS 15.7%

  qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can pla