CVE-2026-110816: CWE-248 Uncaught Exception in ljharb qs

The 'qs' library's stringify function with arrayFormat 'comma' throws a TypeError when an array element cannot be converted to a primitive string value, such as objects with a non-callable toString property or null-prototype objects. This occurs because the implementation uses Array.prototype.join and String coercion without guarding against elements whose string coercion fails. The flaw affects versions >=6.7.0 and <6.16.1 and was fixed in v6.16.1 by coercing such elements to their primitive valueOf or falling back to Object.prototype.toString, preventing the exception. The vulnerability can be triggered by attacker-controlled input parsed with qs.parse using allowPrototypes: true or plainObjects: true, which can produce such problematic objects.

An unauthenticated attacker can cause any code path that re-serializes attacker-influenced data with qs.stringify using arrayFormat 'comma' to throw a synchronous TypeError. In typical Node.js HTTP frameworks, this results in a 500 error response with the process continuing normally. However, in contexts without proper error boundaries, such as async Express 4 handlers or bare HTTP handlers, the unhandled exception can cause the process to exit, leading to denial of service. There is no impact on confidentiality or integrity, only availability (denial of service).

A fix is available in qs version 6.16.1. Users should upgrade to v6.16.1 or later to resolve this issue. Until upgraded, avoid using arrayFormat 'comma' with untrusted input that may contain objects with non-callable toString properties or null prototypes. Also, consider disabling allowPrototypes or plainObjects options in qs.parse to prevent creation of such objects. The vulnerability is fixed and no further action is required once updated.