Findings

CVE-2026-8723

### Summary throws when called with and on an array containing or .

Published May 17, 2026 · updated Jun 17, 2026

### Summary throws when called with and on an array containing or . The throw is synchronous and not handled by any of qs's null-related options ( , ). ### Details In the comma + branch, mapped the array through the raw encoder before joining: ( ) reads with no null guard, so a or element throws . and are both checked in the per-element loop below this line and never get a chance to run. Same class of bug as the filter-array path fixed in 0c180a4. The vulnerable shape of the comma + branch was introduced in 4c4b23d ("encode comma values more consistently", PR #463, 2023-01-19), first released in v6.11.1. #### PoC #### Fix , applied in 21f80b3 on and released as v6.15.2: and now pass through unchanged and reach the step as-is. For this produces , matching the non- comma path (which already joins before encoding and produces for the same input). Single-element arrays still collapse via the existing and remain subject to / in the main loop. ### Affected versions — fixed in v6.15.2. The vulnerable code shape was introduced in 4c4b23d and first shipped in v6.11.1. Earlier versions — including all of 6.7.x, 6.8.x, 6.9.x, 6.10.x, and 6.11.0 — implemented the comma + path differently (joining before encoding) and are not affected. Empirically verified across released versions. ### Impact Application code that calls with both and (both non-default) on input that may contain a or array element will throw synchronously instead of producing a query string. In a typical Node.js HTTP framework (Express, Fastify, Koa, hapi) the sync throw is caught by the framework's error boundary and the affected request returns a 500; the worker process does not exit and subsequent requests are unaffected. The "kills the worker process" framing applies only to call sites outside a request-handler error boundary (background jobs, startup paths, stream pipelines) or to deployments with framework error handling explicitly disabled. The vulnerable input is a or entry inside an array; this is reacha