Ljharb

When using `qs.stringify` with the `allowEmptyArrays` option set to `true`, the software fails to encode the keys of empty arrays. This occurs because the `allowEmptyArrays` branch in `lib/stringify.js` returns the key early, bypassing the `encoder` and `formatter` functions. If a caller-supplied key contains special characters such as `&` (or a custom delimiter), `=`, or `#`, these characters are treated as query string syntax rather than data. This allows an attacker to inject additional parameters into the serialized query string or prematurely terminate the string using a `#` character, which converts the remainder of the URL into a fragment. This issue specifically affects keys whose values are empty arrays and does not occur when `encode` is set to `false` or `encodeValuesOnly` is set to `true`.

When using `qs.stringify` with the `arrayFormat` set to `comma`, the application may throw a `TypeError: Cannot convert object to primitive value`. This occurs when an array element cannot be coerced into a string, such as a null-prototype object or an object containing a non-callable `toString` property. The issue stems from the use of `Array.prototype.join` in `lib/stringify.js` and the `String()` function in `utils.encode` within `lib/utils.js` when `encodeValuesOnly` is enabled, neither of which handle failed string coercion. An unauthenticated attacker can trigger this by providing specially crafted input that is later re-serialized. Depending on the environment, this can result in a 500 Internal Server Error or, if the call occurs outside an error boundary (such as in an `async` Express 4 handler), it can lead to a process crash.

The `qs.stringify` function can throw a `TypeError` when serializing an object that contains a `constructor` property with a truthy, non-callable `isBuffer` member. This occurs because the `utils.isBuffer()` function performs duck-typing by invoking `obj.constructor.isBuffer(obj)` without first verifying that `isBuffer` is actually a function. An attacker can trigger this by providing specially crafted input via `qs.parse` (using `plainObjects: true` or `allowPrototypes: true`) or through `JSON.parse`. In environments like Express 4 or body-parser with `extended: true`, such input can be passed directly through `req.query` or `req.body`. This can lead to a denial of service where the affected request returns a 500 error, or in cases where the call occurs outside an error boundary (such as in an `async` handler), it may cause the entire process to exit.

The `parse()` function finalizes parsed tokens using `Array.prototype.concat` as a reduce accumulator, which causes the entire growing array to be reallocated and copied during every iteration. This results in quadratic time complexity relative to the number of input tokens. An attacker providing a controlled string to any code path that calls `parse()` can block the single-threaded Node.js event loop for an extended period, leading to a denial of service. This issue affects availability and does not allow for code execution or data disclosure.

The `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (") characters. This allows an attacker to perform CRLF injection (Carriage Return Line Feed injection), which is the process of inserting special characters to manipulate the structure of an HTTP header. If an application uses untrusted input as a field name or filename, an attacker can terminate the header line to inject additional headers or smuggle entire multipart parts into the request forwarded to a backend. This can enable the attacker to add or override form fields, such as setting `is admin=true`, as seen by the downstream parser.

When the `qs.parse` function is used with the `comma` and `throwOnLimitExceeded` options set to `true`, a comma-separated value assigned to a bracket-push key (e.g., `a[]=1,2,3,4`) is split into an array without being validated against the `arrayLimit`. In contrast, the same value assigned to flat, indexed, nested, or dotted keys correctly triggers a `RangeError`. This occurs because the `arrayLimit` check in `lib/parse.js` was applied after the value was wrapped as a nested element, and a subsequent attempt to fix this using an `isFlatArrayValue` flag failed to account for the `[]=` key form. An unauthenticated attacker can exploit this by providing a single `a[]=` parameter to bypass configured limits and force the parser to allocate an array proportional to the request size, potentially leading to excessive memory consumption.