CVE-2022-24999

CVE-2022-24999 このリポジトリには、2021年12月にJSライブラリ「qs」で発見した脆弱性のエクスプロイトサンプルが含まれています。 この脆弱性は、express v4.17.3 および qs v6.10.3 v6.9.7, v6.8.3, v6.7.3, v6.6.1, v6.5.3, v6.4.1, v6.3.3, v6.2.4 で修正されました。 qs Array & String Bombs 脆弱なバージョンの「qs」では、出力JSオブジェクトに「proto 」プロパティを作成することができます。 「...

EUVD-2026-77073

A security flaw has been discovered in kagisearch smallweb up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf. The affected element is the function index of the file app/sw.py of the component Query String Rendering. Performing a manipulation of the argument qs results in cross site scripting. The...

ROOT-APP-NPM-CVE-2025-15284 CVE-2025-15284 in qs - Patched by Root

Root has patched CVE-2025-15284 in the qs package for Root:npm. Multiple fixed versions available...

qs: qs: Denial of Service via array limit bypass in query string parsing

A flaw was found in qs. An unauthenticated attacker can exploit this by sending a specially crafted query string to an application using qs.parse with specific non-default settings comma: true and throwOnLimitExceeded: true. This bypasses a configured array limit, causing the parser to allocate a...

qs: qs: Denial of Service via improper validation in stringify function

A flaw was found in qs. The qs.stringify function, responsible for serializing objects, does not properly validate the isBuffer property of an object's constructor before attempting to invoke it. An unauthenticated attacker can provide specially crafted input that, when processed and then...

CVE-2026-82417

A flaw was found in qs. The qs.stringify function, responsible for serializing objects, does not properly validate the isBuffer property of an object's constructor before attempting to invoke it. An unauthenticated attacker can provide specially crafted input that, when processed and then...

EUVD-2026-68141

qs array-limit bypass via bracket-key comma parsing...

GHSA-X5FP-WJ9C-MXMX qs array-limit bypass via bracket-key comma parsing

Summary qs v6.15.3 allows bracket-key input to bypass arrayLimit and throwOnLimitExceeded when comma: true. The input a=1,2,3,4 succeeds with arrayLimit: 3, while the equivalent plain-key input is rejected. Affected version tested: text qs v6.15.3 commit 18d085e919dae70c8f1b200ab99323058edab2c2...

GHSA-4MJR-XMP4-GH2G qs: Denial of Service via Attacker Controlled isBuffer

Summary qs.stringify calls utils.isBuffer on every value it serializes, and utils.isBuffer invokes obj.constructor.isBufferobj without checking that it is callable. A value whose own constructor.isBuffer is a non-function makes qs call a non-callable and throw TypeError. Such a value is produced ...

EUVD-2026-68140

qs: Denial of Service via Attacker Controlled isBuffer...

CVE-2026-82562

A flaw was found in qs. An unauthenticated attacker can exploit this by sending a specially crafted query string to an application using qs.parse with specific non-default settings comma: true and throwOnLimitExceeded: true. This bypasses a configured array limit, causing the parser to allocate a...

qs: qs: Denial of Service via improper validation in stringify function

A flaw was found in qs. The qs.stringify function, responsible for serializing objects, does not properly validate the isBuffer property of an object's constructor before attempting to invoke it. An unauthenticated attacker can provide specially crafted input that, when processed and then...

qs: qs: Denial of Service via array limit bypass in query string parsing

A flaw was found in qs. An unauthenticated attacker can exploit this by sending a specially crafted query string to an application using qs.parse with specific non-default settings comma: true and throwOnLimitExceeded: true. This bypasses a configured array limit, causing the parser to allocate a...

Uncaught Exception

Overview qs is a querystring parser that supports nesting and arrays, with a depth limit. Affected versions of this package are vulnerable to Uncaught Exception in the isBuffer function in lib/utils.js, which calls obj.constructor.isBufferobj without checking that it is callable, reached from...

Uncaught Exception

Overview org.webjars.npm:qs is a querystring parser that supports nesting and arrays, with a depth limit. Affected versions of this package are vulnerable to Uncaught Exception in the isBuffer function in lib/utils.js, which calls obj.constructor.isBufferobj without checking that it is callable,...

org.webjars.npm:adal-node (0.1.28), org.webjars.npm:angular-lock (2.0.3) +82 more potentially affected by CVE-2026-82417 via org.webjars.npm:qs (>=0.6.6, <=6.15.3)

org.webjars.npm:qs MAVEN version =0.6.6, =8.4.0, =1.4.3, =1.5.2, =4.14.0, =4.18.1 and more Source cves: CVE-2026-82417 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-19432020...

org.webjars.npm:adal-node (0.1.28), org.webjars.npm:angular-lock (2.0.3) +82 more potentially affected by CVE-2026-82562 via org.webjars.npm:qs (>=0.6.6, <=6.15.3)

org.webjars.npm:qs MAVEN version =0.6.6, =8.4.0, =1.4.3, =1.5.2, =4.14.0, =4.18.1 and more Source cves: CVE-2026-82562 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-19432018...

Allocation of Resources Without Limits or Throttling

Overview qs is a querystring parser that supports nesting and arrays, with a depth limit. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the parseArrayValue comma-parsing logic, which applies the arrayLimit and throwOnLimitExceeded chec...

Allocation of Resources Without Limits or Throttling

Overview org.webjars.npm:qs is a querystring parser that supports nesting and arrays, with a depth limit. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the parseArrayValue comma-parsing logic, which applies the arrayLimit and...

CVE-2026-82562

Summary When qs.parse is called with comma: true and throwOnLimitExceeded: true, a comma-separated value under a bracket-push key a=1,2,3,4 is split into an array without being compared against arrayLimit, while the same value under a flat key a=1,2,3,4, an indexed key a0=, a nested key ab=, or a...