ljharb

qs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391)

qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property

shell-quote parse() is quadratic in token count, enabling denial of service