Vulnerabilities

Vulnerability · CVE-2026-110816

qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a string

Published Oct 14, 2026 · catalog updated Oct 14, 2026 · qs.stringify with arrayFormat comma

Check if you run it

No confirmed exploitation is on record for CVE-2026-110816. EPSS is 0.30%. Act only if a listed version of qs.stringify with arrayFormat comma is installed.

Severity

Medium6.3

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

0.30%

Remediation

Advisory link

Affected products

vendor ljharb qs

### Summary with throws when an array element cannot be coerced to a string, such as an object with an own non-callable ( ) or a null-prototype object. The comma format joins array elements with and, under , first passes each element through in ; neither guards against an element whose string coercion fails. ### Details In , the comma branch collapses the array with . For an element whose own is not callable, skips it, falls through to (which returns the object itself), and throws. Under , the same element first reaches in ( ) and throws there. Nested arrays ( ) throw the same way, through . The , , and formats walk into object elements instead of coercing them, and are not affected. Such elements can come from untrusted input. produces with no qs option involved. keeps the key, and produces a null-prototype element; the default parse options drop and produce ordinary objects, which do not throw. Express 4's default , Express 5's query parser, and body-parser's all call with . #### PoC #### Fix Applied in a952e75 on and released as v6.16.1: an element whose string coercion would fail is coerced to its primitive , if any, or else to , so it renders as , the same as any other object element already does under the comma format. Nested arrays are walked the way walks them. Every input that did not previously throw serializes exactly as before, and a or that itself throws still propagates. ### Affected versions , fixed in v6.16.1. The path was introduced with the comma format in b84acba and first shipped in v6.7.0; v6.6.x and earlier ignore and are not affected. The site was introduced in 4c4b23d (v6.11.1); before that, the same input throws at . Every release from v6.7.0 through v6.16.0 is affected. ### Impact An unauthenticated request can make any code path that re-serializes attacker-influenced data with and (for example, rebuilding a query string from for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js