The vulnerability arises from qs.stringify's handling of arrays when both arrayFormat: 'comma' and encodeValuesOnly: true are set. The code attempts to encode array elements without null checks, leading to a TypeError when encountering null or undefined values. This occurs because the encoder reads the length property of these nullish values without guarding against them. The bug was introduced in version 6.11.1 and fixed in 6.15.2 by bypassing encoding for null or undefined elements before joining the array into a string.

Applications using vulnerable versions of qs (>=6.11.1 <6.15.2) with the specified options and input containing null or undefined array elements will experience synchronous exceptions causing HTTP 500 errors in request handlers. This does not lead to worker process crashes under typical Node.js frameworks with error boundaries. The impact is limited to denial of service for affected requests and does not affect confidentiality or integrity.

Upgrade to qs version 6.15.2 or later, where the issue is fixed. If upgrading is not immediately possible, avoid calling qs.stringify with both arrayFormat: 'comma' and encodeValuesOnly: true on arrays that may contain null or undefined values. Patch status is not explicitly stated in the vendor advisory, but the fix is included in version 6.15.2 as per the provided details.