ljharb vulnerabilities

qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection

ljharb · qs

qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a string

ljharb · qs

traverse: set() can write to built-in prototypes via an untrusted path

ljharb · traverse

qs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391)

ljharb · qs

qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property

ljharb · qs

shell-quote parse() is quadratic in token count, enabling denial of service

ljharb · shell-quote

qs.stringify crashes on null/undefined entries in comma-format arrays under encodeValuesOnly

ljharb · qs

OS Command Injection in ljharb/npm-lockfile

ljharb · ljharb/npm-lockfile