qs 6.15.3 | Snyk

Direct Vulnerabilities

Known vulnerabilities in the qs package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Uncaught Exception qs is a querystring parser that supports nesting and arrays, with a depth limit. Affected versions of this package are vulnerable to Uncaught Exception in the `isBuffer()` function in `lib/utils.js`, which calls `obj.constructor.isBuffer(obj)` without checking that it is callable, reached from `stringify()` at `lib/stringify.js:127`. An attacker can throw an uncaught `TypeError` that fails each request with HTTP 500, and terminates the worker process when `stringify()` runs in an unguarded async context, by supplying a query string such as `x[constructor][isBuffer]=y` that sets `constructor.isBuffer` to a non-function value. This requires the application to call `qs.parse()` with `plainObjects: true` or `allowPrototypes: true`, which preserves the `constructor` own property, and to then pass the parsed result to `qs.stringify()`. How to fix Uncaught Exception? Upgrade `qs` to version 6.16.0 or higher.	>=2.2.5 <6.16.0
M Allocation of Resources Without Limits or Throttling qs is a querystring parser that supports nesting and arrays, with a depth limit. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `parseArrayValue()` comma-parsing logic, which applies the `arrayLimit` and `throwOnLimitExceeded` checks only to flat values, so a bracket-key input such as `a[]=1,2,3,4` is treated as non-flat and its comma-split inner array is wrapped after parsing without ever being length-checked. An attacker can exceed the configured array limit and force excessive memory allocation by supplying a query string or form body that uses the bracket-key comma form, for example `a[]=1,2,3,...`. This requires the application to parse untrusted input with the `comma: true` option enabled alongside a configured `arrayLimit` or `throwOnLimitExceeded`. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `qs` to version 6.16.0 or higher.	>=6.14.2 <6.16.0

Vulnerability

Vulnerable Version

Uncaught Exception

qs is a querystring parser that supports nesting and arrays, with a depth limit.

Affected versions of this package are vulnerable to Uncaught Exception in the isBuffer() function in lib/utils.js, which calls obj.constructor.isBuffer(obj) without checking that it is callable, reached from stringify() at lib/stringify.js:127. An attacker can throw an uncaught TypeError that fails each request with HTTP 500, and terminates the worker process when stringify() runs in an unguarded async context, by supplying a query string such as x[constructor][isBuffer]=y that sets constructor.isBuffer to a non-function value. This requires the application to call qs.parse() with plainObjects: true or allowPrototypes: true, which preserves the constructor own property, and to then pass the parsed result to qs.stringify().

How to fix Uncaught Exception?

Upgrade qs to version 6.16.0 or higher.

>=2.2.5 <6.16.0

Allocation of Resources Without Limits or Throttling

qs is a querystring parser that supports nesting and arrays, with a depth limit.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the parseArrayValue() comma-parsing logic, which applies the arrayLimit and throwOnLimitExceeded checks only to flat values, so a bracket-key input such as a[]=1,2,3,4 is treated as non-flat and its comma-split inner array is wrapped after parsing without ever being length-checked. An attacker can exceed the configured array limit and force excessive memory allocation by supplying a query string or form body that uses the bracket-key comma form, for example a[]=1,2,3,.... This requires the application to parse untrusted input with the comma: true option enabled alongside a configured arrayLimit or throwOnLimitExceeded.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade qs to version 6.16.0 or higher.

>=6.14.2 <6.16.0

qs@6.15.3

A querystring parser that supports nesting and arrays, with a depth limit

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically