CVE-2026-110816

Name of the Vulnerable Software and Affected Versions qs versions 6.7.0 through 6.16.0

Description When using qs.stringify with the arrayFormat set to comma, the application may throw a TypeError: Cannot convert object to primitive value. This occurs when an array element cannot be coerced into a string, such as a null-prototype object or an object containing a non-callable toString property. The issue stems from the use of Array.prototype.join in lib/stringify.js and the String() function in utils.encode within lib/utils.js when encodeValuesOnly is enabled, neither of which handle failed string coercion.

An unauthenticated attacker can trigger this by providing specially crafted input that is later re-serialized. Depending on the environment, this can result in a 500 Internal Server Error or, if the call occurs outside an error boundary (such as in an async Express 4 handler), it can lead to a process crash.

Recommendations Update qs to version 6.16.1 or later. As a temporary mitigation, avoid using arrayFormat: 'comma' when serializing data that may be influenced by untrusted users.