CVE-2026-110910

Name of the Vulnerable Software and Affected Versions qs versions 6.12.0 through 6.12.5 qs versions 6.13.0 through 6.13.3 qs versions 6.14.0 through 6.14.2 qs versions 6.15.0 through 6.15.3 qs versions 6.16.0 through 6.16.1

Description When using qs.stringify with the allowEmptyArrays option set to true, the software fails to encode the keys of empty arrays. This occurs because the allowEmptyArrays branch in lib/stringify.js returns the key early, bypassing the encoder and formatter functions. If a caller-supplied key contains special characters such as & (or a custom delimiter), =, or #, these characters are treated as query string syntax rather than data. This allows an attacker to inject additional parameters into the serialized query string or prematurely terminate the string using a # character, which converts the remainder of the URL into a fragment. This issue specifically affects keys whose values are empty arrays and does not occur when encode is set to false or encodeValuesOnly is set to true.

Recommendations Update qs to version 6.12.6 for installations on the 6.12.x branch. Update qs to version 6.13.4 for installations on the 6.13.x branch. Update qs to version 6.14.3 for installations on the 6.14.x branch. Update qs to version 6.15.4 for installations on the 6.15.x branch. Update qs to version 6.16.2 for installations on the 6.16.x branch. Update qs to version 6.17.0 or later. As a temporary mitigation, avoid setting allowEmptyArrays: true when processing objects with keys derived from untrusted input.