StackPrism

npm package

qs vulnerabilities by version

The latest release, 6.16.1 (Oct 14, 2026), has no known vulnerabilities. 64% of last week’s 189.4M downloads went to versions with known vulnerabilities. OSV.dev lists 9 advisories for qs; the newest was published on Sep 2, 2026.

npm (opens in a new tab) describes it as “A querystring parser that supports nesting and arrays, with a depth limit”

Latest release
6.16.1
Oct 14, 2026, no known vulnerabilities
Downloads last week
189.4M
All versions, from npm
Advisories on OSV.dev
9
Newest Sep 2, 2026
Licence
BSD-3-Clause
OpenSSF Scorecard
5.4/10
ljharb/qs (opens in a new tab)

Most-downloaded versions last week

From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilitiesDownloads
6.16.0Aug 29, 2026No known vulnerabilities67.2M
6.15.3Jun 24, 20262 known vulnerabilities, worst rated warning20.9M
6.15.2May 16, 20262 known vulnerabilities, worst rated warning17.5M
6.14.0Jan 14, 20254 known vulnerabilities, worst rated warning13.5M
6.13.0Aug 1, 20244 known vulnerabilities, worst rated warning9.7M
6.14.2Feb 11, 20263 known vulnerabilities, worst rated warning9.5M
6.15.1Apr 8, 20263 known vulnerabilities, worst rated warning7.7M
6.15.0Feb 15, 20263 known vulnerabilities, worst rated warning7.3M

Who is still on a vulnerable qs

64% of last week’s 189.4M qs downloads went to versions with known vulnerabilities.

From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.

Release lines

The newest release of each major line, from the registry. qs doesn’t publish support dates we can check.

LineNewest releaseReleased
66.16.1Oct 14, 2026
55.2.1Jul 20, 2016
44.0.0Jul 2, 2015
33.1.0May 27, 2015
22.4.2May 9, 2015
11.2.2Aug 14, 2014

Newest advisories

The 5 most recently published, with the versions each one affects.

  1. WarningCVE-2026-82562 on OSV.dev (opens in a new tab)GHSA-x5fp-wj9c-mxmx

    qs array-limit bypass via bracket-key comma parsing

    Affects >= 6.14.2, < 6.16.0. Published Sep 2, 2026.

  2. WarningCVE-2026-82417 on OSV.dev (opens in a new tab)GHSA-4mjr-xmp4-gh2g

    qs: Denial of Service via Attacker Controlled isBuffer

    Affects >= 2.2.5, < 6.16.0. Published Sep 2, 2026.

  3. WarningCVE-2026-8723 on OSV.dev (opens in a new tab)GHSA-q8mj-m7cp-5q26

    qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set

    Affects >= 6.11.1, < 6.15.2. Published May 22, 2026.

  4. LowCVE-2026-2391 on OSV.dev (opens in a new tab)GHSA-w7fw-mjwx-w883

    qs's arrayLimit bypass in comma parsing allows denial of service

    Affects >= 6.7.0, < 6.14.2. Published Feb 12, 2026.

  5. WarningCVE-2025-15284 on OSV.dev (opens in a new tab)GHSA-6rw7-vpxm-498p

    qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion

    Affects < 6.14.1. Published Dec 30, 2025.

All 9 advisories are on OSV.dev (opens in a new tab).

Which qs do you have?

Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for qs, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, npm and deps.dev.