All 4 CVE vulnerabilities found in qs, with AI-generated Chinese analysis, references, and POCs.
Vendor: ljharb
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-110816 | qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a string CWE-248 | 5.3 | Medium | 2026-10-14 |
| CVE-2026-82562 | qs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391) CWE-770 | 3.7 | Low | 2026-08-29 |
| CVE-2026-82417 | qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property CWE-248 | 5.3 | Medium | 2026-08-29 |
| CVE-2026-8723 | qs.stringify crashes on null/undefined entries in comma-format arrays under encodeValuesOnly CWE-476 | 5.3 | Medium | 2026-05-16 |
All 4 known CVE vulnerabilities affecting qs with full Chinese analysis, references, and POCs where available.