CVE-2026-110910

Summary qs.stringify with allowEmptyArrays: true writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains & or the configured delimiter, =, or therefore becomes query string syntax instead of data, so a caller-supplied key name can add...