Lljharb

Products

Exploited and recent CVEs

• CVE-2026-110910 Low 3.7 qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection 0.3%
• CVE-2026-110816 Medium 5.3 qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a string 0.4%
• CVE-2026-107353 Medium 6.5 traverse: set() can write to built-in prototypes via an untrusted path 0.3%
• CVE-2026-82562 Low 3.7 qs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391) 0.5%
• CVE-2026-82417 Medium 5.3 qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property 0.4%
• CVE-2026-13311 High 7.5 shell-quote parse() is quadratic in token count, enabling denial of service 0.4%
• CVE-2026-8723 Medium 5.3 qs.stringify crashes on null/undefined entries in comma-format arrays under encodeValuesOnly 0.4%
• CVE-2022-0841 Low 3.8 OS Command Injection in ljharb/npm-lockfile 2.5%