CVE-2026-8723 qs.stringify crashes on null/undefined entries in comma-format arrays under encodeValuesOnly

🗓️ 16 May 2026 23:21:16Reported by harboristType

qs.stringify crashes on null or undefined values with comma format and encodeValuesOnly; fixed by preserving nulls in maybeMap.

Reporter	Title	Published	Views	Family All 426
IBM Security Bulletins	Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFixes for July 2026.	5 Aug 202610:13	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in qs.stringify affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	25 Aug 202618:23	–	ibm
IBM Security Bulletins	Security Bulletin: MongoDB Enterprised Advanced affected by: NULL Pointer Dereference (CVE-2026-8723)	3 Sep 202619:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in qs-6.14.2.tgz	9 Jun 202614:57	–	ibm
IBM Security Bulletins	Security Bulletin: The Log Source Management App for IBM QRadar SIEM contains components with known vulnerabilities	14 Aug 202618:27	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Aspera Enterprise Webapps	9 Jul 202601:28	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to vulnerability in qs	7 Jul 202610:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Application Modernization Accelerator is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty	10 Jul 202612:21	–	ibm
IBM Security Bulletins	Security Bulletin:QS.stringify TypeError with arrayFormat: comma and encodeValuesOnly:true on null/undefined Arrays	4 Aug 202610:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watsonx BI Assistant for CP4D affected by multiple CVEs	9 Sep 202619:32	–	ibm

[
  {
    "vendor": "ljharb",
    "product": "qs",
    "collectionURL": "https://npmjs.com/qs",
    "packageName": "qs",
    "repo": "https://github.com/ljharb/qs",
    "versions": [
      {
        "status": "affected",
        "version": "6.11.1",
        "lessThan": "6.15.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
github	www.github.com/ljharb/qs/commit/21f80b33e5c8b3f7eba1034fff0da4a4a37a1d41
github	www.github.com/ljharb/qs/security/advisories/GHSA-q8mj-m7cp-5q26

16 May 2026 23:21Current

CVSS 3.15.3

CVSS 46.3

EPSS0.00358

CWE-476