CVE-2026-110910

Summary "qs.stringify" with "allowEmptyArrays: true" writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains "&" or the configured "delimiter", "=", or "" therefore becomes query string syntax instead of data, so a caller-supplied key nam...