When using `qs.stringify` with the `arrayFormat` set to `comma`, the application may throw a `TypeError: Cannot convert object to primitive value`. This occurs when an array element cannot be coerced into a string, such as a null-prototype object or an object containing a non-callable `toString` property. The issue stems from the use of `Array.prototype.join` in `lib/stringify.js` and the `String()` function in `utils.encode` within `lib/utils.js` when `encodeValuesOnly` is enabled, neither of which handle failed string coercion.
An unauthenticated attacker can trigger this by providing specially crafted input that is later re-serialized. Depending on the environment, this can result in a 500 Internal Server Error or, if the call occurs outside an error boundary (such as in an `async` Express 4 handler), it can lead to a process crash.