Known vulnerabilities in qs
Vendor:
npm Inc.
Software:
qs
Software CPE:
cpe:2.3:a:npm:qs:*:*:*:*:*:nodejs:*:*
Website:
https://www.npmjs.com/
Total vulnerabilities:
6
Public exploits:
1
Known exploited (KEV):
0
Highest CVSSv4 Score:
8.8
Breakdown by Severity Chart
6.15.3
6.15.2
6.15.1
6.15.0
6.12.5
6.11.4
6.10.7
6.9.9
6.8.5
6.7.5
6.6.3
6.5.5
6.4.3
6.3.5
6.14.2
6.14.1
6.14.0
6.13.1
6.13.0
6.12.3
6.12.2
6.12.1
6.12.0
6.11.2
6.11.1
6.11.0
6.10.5
6.10.4
6.10.3
6.10.2
6.10.1
6.10.0
6.9.7
6.9.6
6.9.5
6.9.4
6.9.3
6.9.2
6.9.1
6.9.0
6.8.3
6.8.2
6.8.1
6.8.0
6.7.3
6.7.2
6.7.1
6.7.0
6.6.1
6.6.0
6.5.3
6.5.2
6.5.1
6.5.0
6.4.1
6.4.0
6.3.3
6.3.2
6.2.4
6.2.3
6.1.2
6.0.4
2.3.0
2.2.5
2.2.4
2.2.3
2.2.2
2.2.1
2.2.0
2.1.0
2.0.0
1.2.2
3.1.0
2.4.0
2.3.1
2.4.1
2.3.2
2.4.2
2.3.3
3.0.0
1.2.1
6.1.0
6.0.1
6.0.0
6.3.0
6.2.1
6.0.3
6.2.0
6.1.1
6.0.2
6.3.1
6.2.2
4.0.0
5.2.0
5.1.0
5.0.0
1.1.0
1.0.1
1.2.0
1.0.2
5.2.1
0.6.6
0.6.5
0.6.4
0.6.3
0.6.2
0.6.1
0.6.0
0.5.6
0.5.5
0.5.4
0.5.3
0.5.2
0.5.1
0.5.0
0.4.2
0.4.1
0.4.0
0.3.2
0.3.1
0.3.0
0.2.0
0.1.0
0.0.7
0.0.6
0.0.5
0.0.4
0.0.3
0.0.2
0.0.1
1.0.0
Vulnerabilities (6)
| Vulnerability | CWE-ID | CSH Severity | Public Exploit | KEV | First fixed release | Published | Bulletins |
|---|---|---|---|---|---|---|---|
| #VU131746 - NULL Pointer Dereference CVE-2026-8723 |
CWE-476 | Medium | 6.15.2 | 18.05.2026 |
SB2026051892 SB2026061048 SB2026062221 and 5 more |
||
| #VU123997 - Improper input validation CVE-2026-2391 |
CWE-20 | Medium | 6.14.2 | 13.03.2026 |
SB2026031335 SB2026031336 SB2026032417 and 13 more |
||
| #VU121159 - Resource exhaustion CVE-2025-15284 |
CWE-400 | Medium | 6.14.1 | 12.01.2026 |
SB2026011229 SB2026011326 SB2026011926 and 38 more |
||
| #VU69675 - Improper Control of Generation of Code ('Code Injection') CVE-2022-24999 |
CWE-94 | Medium | 6.2.4, 6.3.3, 6.4.1, 6.5.3, 6.6.1, 6.7.3, 6.8.3, 6.9.7, 6.10.3 | 29.11.2022 |
SB2022112910 SB2022112911 SB2022112943 and 49 more |
||
| #VU14299 - Improper input validation CVE-2014-10064 |
CWE-20 | Low | 1.0.0 | 09.08.2018 |
SB2014080601 SB2024042408 |
||
| #VU38700 - Improper input validation CVE-2017-1000048 |
CWE-20 | Medium | - | 17.07.2017 |
SB2017071720 SB2023052313 SB2023092025 and 4 more |