qs vulnerabilities and fixes

Q: How do I fix qs vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Q: Is qs being exploited right now?

None of the tracked qs CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Q: Which qs CVE should I patch first?

CVE-2026-2391 currently ranks highest (34/100): ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true.

Recent CVEs affecting qs, with upgrade or downgrade steps. 2 tracked.

qs has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-02-12. Highest priority: CVE-2026-2391 (score 34/100).

CVE-2025-15284 LOW 3.7 UPGRADE Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.
CVE-2026-2391 LOW 3.7 UPGRADE ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true

FAQ

How do I fix qs vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is qs being exploited right now?

None of the tracked qs CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which qs CVE should I patch first?

CVE-2026-2391 currently ranks highest (34/100): ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true.

← Back to latest CVEs