ljharb vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20267

Newest CVEs

• CVE-2026-110910

  qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection

  ljharb · qs

  Medium6.3
• CVE-2026-110816

  qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a string

  ljharb · qs

  Medium6.3
• CVE-2026-107353

  traverse: set() can write to built-in prototypes via an untrusted path

  ljharb · traverse

  Medium6.9
• CVE-2026-82562

  qs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391)

  ljharb · qs

  Medium6.3
• CVE-2026-82417

  qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property

  ljharb · qs

  Medium6.3
• CVE-2026-13311

  shell-quote parse() is quadratic in token count, enabling denial of service

  ljharb · shell-quote

  High8.7
• CVE-2026-8723

  qs.stringify crashes on null/undefined entries in comma-format arrays under encodeValuesOnly

  ljharb · qs

  Medium6.3
• CVE-2022-0841

  OS Command Injection in ljharb/npm-lockfile

  ljharb · ljharb/npm-lockfile

  Low3.8