CVE-2026-110910

Summary qs.stringify with allowEmptyArrays: true writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains & or the configured delimiter, =, or therefore becomes query string syntax instead of data, so a caller-supplied key name can add...

Linux Distros Unpatched Vulnerability : CVE-2026-110910

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Summary qs.stringify with allowEmptyArrays: true writes the key of an empty array without encoding it, even though keys are encoded by default. A key that...

Qs : Qs.stringify With ArrayFormat 'comma' Throws An Uncaught TypeError On Array Elements Carrying A Non-callable Own To

Summary "qs.stringifyobj, arrayFormat: 'comma' " throws an uncaught "TypeError: Cannot convert object to primitive value" when an array in "obj" contains an element that carries an own, non-callable "toString" property for example " a: toString: 'x' ". A remote, unauthenticated attacker who can...

SUSE CVE-2026-110910

Summary qs.stringify with allowEmptyArrays: true writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains & or the configured delimiter, =, or therefore becomes query string syntax instead of data, so a caller-supplied key name can add...

GHSA-6PQ8-JHM2-2VCW qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)

Summary qs.stringifyobj, arrayFormat: 'comma' throws an uncaught TypeError: Cannot convert object to primitive value when an array in obj contains an element that carries an own, non-callable toString property for example a: toString: 'x' . A remote, unauthenticated attacker who can influence an...

EUVD-2026-101710

qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString DoS...

Improper Encoding or Escaping of Output

Overview qs is a querystring parser that supports nesting and arrays, with a depth limit. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the stringify function when the allowEmptyArrays option is enabled. When an object key contains special...

Improper Encoding or Escaping of Output

Overview org.webjars.npm:qs is a querystring parser that supports nesting and arrays, with a depth limit. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the stringify function when the allowEmptyArrays option is enabled. When an object key contains...

CVE-2026-110910

Summary qs.stringify with allowEmptyArrays: true writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains & or the configured delimiter, =, or therefore becomes query string syntax instead of data, so a caller-supplied key name can add...

DEBIAN-CVE-2026-110910

Summary qs.stringify with allowEmptyArrays: true writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains & or the configured delimiter, =, or therefore becomes query string syntax instead of data, so a caller-supplied key name can add...

EUVD-2026-110630

Summary qs.stringify with allowEmptyArrays: true writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains & or the configured delimiter, =, or therefore becomes query string syntax instead of data, so a caller-supplied key name can add...

PT-2026-125882

Summary qs.stringify with allowEmptyArrays: true writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains & or the configured delimiter, =, or ∴ becomes query string syntax instead of data, so a caller-supplied key name can add parameters ...

PT-2026-132893

Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode stringify. encode stringify writes a value in its string form under allow stringify, under convert blessed for objects without TO JSON, and under allow...

PT-2026-117580

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 3.0202 through 4.79 Description Memory leak occurs when encoding values as strings in the encode stringify function. The issue arises when the function writes a value in string form under allow stringify, convert...

Uncaught Exception

Overview qs is a querystring parser that supports nesting and arrays, with a depth limit. Affected versions of this package are vulnerable to Uncaught Exception via stringify when arrayFormat: 'comma' is used with array elements that have a non-callable toString property. Such elements - as...

Uncaught Exception

Overview org.webjars.npm:qs is a querystring parser that supports nesting and arrays, with a depth limit. Affected versions of this package are vulnerable to Uncaught Exception via stringify when arrayFormat: 'comma' is used with array elements that have a non-callable toString property. Such...

CVE-2026-110816 qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a string

Summary qs.stringify with arrayFormat: 'comma' throws TypeError: Cannot convert object to primitive value when an array element cannot be coerced to a string, such as an object with an own non-callable toString "toString": "x" or a null-prototype object. The comma format joins array elements with...

devalue: `stringify`/`uneval` serialize shared memory

Impact stringify and uneval serialize a typed array by emitting its backing ArrayBuffer, not just the view. In the case of a Node Buffer object, the backing buffer is a process-wide shared pool, meaning unrelated memory can be serialized into a response that is then sent to the client. For a Node...

CVE-2026-92708

A flaw was found in devalue, a JavaScript library for serializing values. The stringify and uneval functions incorrectly serialize Node Buffers by emitting the entire backing ArrayBuffer instead of only the view. This vulnerability allows for the disclosure of up to 64 KB of unrelated process...

CVE-2026-92708

Svelte devalue is a JavaScript serialization library for use with SvelteKit, Nuxt, and other frameworks. In versions 5.1.0 through 5.9.2 , the stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view. Since a Node Buffer's backing...