Sourced from The Sonatype OSS Index.

[CVE-2017-1000048] Improper Input Validation
the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.

Affected versions: 1.0.0; 1.0.1; 1.0.2; 1.1.0; 1.2.0; 1.2.1; 2.3.1; 2.3.2; 2.3.3; 2.4.0; 2.4.1; 2.4.2; 3.0.0; 3.1.0; 4.0.0; 5.0.0; 5.1.0; 5.2.0; 5.2.1; 6.0.0; 6.0.1; 6.0.2; 6.0.3; 6.1.0; 6.1.1; 6.2.0; 6.2.1; 6.2.2; 6.3.0; 6.3.1

Sourced from qs's changelog.

6.3.2

• [Fix] follow allowPrototypes option during merge (#201, #200)
• [Dev Deps] update eslint
• [Fix] chmod a-x
• [Fix] support keys starting with brackets (#202, #200)
• [Tests] up to node v7.7, v6.10, v4.8; disable osx builds since they block linux builds

6.3.1

• [Fix] ensure that allowPrototypes: false does not ever shadow Object.prototype properties (thanks, snyk!)
• [Dev Deps] update eslint, @ljharb/eslint-config, browserify, iconv-lite, qs-iconv, tape
• [Tests] on all node minors; improve test matrix
• [Docs] document stringify option allowDots (#195)
• [Docs] add empty object and array values example (#195)
• [Docs] Fix minor inconsistency/typo (#192)
• [Docs] document stringify option sort (#191)
• [Refactor] stringify: throw faster with an invalid encoder
• [Refactor] remove unnecessary escapes (#184)
• Remove contributing.md, since qs is no longer part of hapi (#183)

• 9ee5612 v6.3.2
• 0a63fc8 [Tests] up to node v7.7, v6.10, v4.8; disable osx builds since they b...
• 8e1f3e7 [Fix] support keys starting with brackets.
• febe81a [Fix] chmod a-x
• e54c5ec [Dev Deps] update eslint
• 8e2af08 [Fix] follow allowPrototypes option during merge
• 153ce84 v6.3.1
• d73b7a6 [Dev Deps] update eslint, @ljharb/eslint-config, browserify
• beade02 [Fix] ensure that allowPrototypes: false does not ever shadow Object.protot...
• 8bd4c6c Document allowDots option for stringify
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge
• @dependabot reopen will reopen this PR if it is closed
• @dependabot ignore this [patch|minor|major] version will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

Finally, you can contact us by mentioning @dependabot.