CVE-2026-110910 qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection

Summary qs.stringify with allowEmptyArrays: true writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains & or the configured delimiter, =, or ∴ becomes query string syntax instead of data, so a caller-supplied key name can add parameters ...

CVE-2026-110910

The qs library (versions >=6.12.0