CVE-2026-8723 qs.stringify crashes on null/undefined entries in comma-format arrays under encodeValuesOnly

🗓️ 16 May 2026 23:21:16Reported by harboristType

qs.stringify crashes on null or undefined values with comma format and encodeValuesOnly; fixed by preserving nulls in maybeMap.

Reporter	Title	Published	Views	Family All 82
IBM Security Bulletins	Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFixes for July 2026.	5 Aug 202610:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in qs-6.14.2.tgz	9 Jun 202614:57	–	ibm
IBM Security Bulletins	Security Bulletin: The Log Source Management App for IBM QRadar SIEM contains components with known vulnerabilities	14 Aug 202618:27	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Aspera Enterprise Webapps	9 Jul 202601:28	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to vulnerability in qs	7 Jul 202610:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Application Modernization Accelerator is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty	10 Jul 202612:21	–	ibm
IBM Security Bulletins	Security Bulletin:QS.stringify TypeError with arrayFormat: comma and encodeValuesOnly:true on null/undefined Arrays	4 Aug 202610:06	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been found in IBM Verify Identity Access Digital Credentials	12 Jun 202601:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple dependencies which are vulnerable to multiple CVEs.	30 Jul 202615:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules (CVE-2026-45736, CVE-2026-45149, CVE-2026-3449 & CVE-2026-8723)	29 Jun 202607:47	–	ibm

[
  {
    "vendor": "ljharb",
    "product": "qs",
    "collectionURL": "https://npmjs.com/qs",
    "packageName": "qs",
    "repo": "https://github.com/ljharb/qs",
    "versions": [
      {
        "status": "affected",
        "version": "6.11.1",
        "lessThan": "6.15.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
github	www.github.com/ljharb/qs/commit/21f80b33e5c8b3f7eba1034fff0da4a4a37a1d41
github	www.github.com/ljharb/qs/security/advisories/GHSA-q8mj-m7cp-5q26

16 May 2026 23:21Current

CVSS 3.15.3

CVSS 46.3

EPSS0.00358

CWE-476