Vulnerability	Vulnerable Version
M Improper Encoding or Escaping of Output qs is a querystring parser that supports nesting and arrays, with a depth limit. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the `stringify` function when the `allowEmptyArrays` option is enabled. When an object key contains special characters (such as `&`, `=`, or `#`) and its value is an empty array, the key is returned without encoding, allowing an attacker who controls a key name to inject arbitrary query-string parameters or URL fragments into the serialized output. A consumer that parses the resulting string will see attacker-controlled key-value pairs that were not present in the original object. How to fix Improper Encoding or Escaping of Output? Upgrade `qs` to version 6.17.0 or higher.	>=6.12.0 <6.17.0

Improper Encoding or Escaping of Output

qs is a querystring parser that supports nesting and arrays, with a depth limit.

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the stringify function when the allowEmptyArrays option is enabled. When an object key contains special characters (such as &, =, or #) and its value is an empty array, the key is returned without encoding, allowing an attacker who controls a key name to inject arbitrary query-string parameters or URL fragments into the serialized output. A consumer that parses the resulting string will see attacker-controlled key-value pairs that were not present in the original object.

How to fix Improper Encoding or Escaping of Output?

Upgrade qs to version 6.17.0 or higher.

>=6.12.0 <6.17.0

Go back to all versions of this package