Threats tagged 'ghsa-6pq8-jhm2-2vcw'

The qs library version 6.7.0 through 6.16.0 has a vulnerability in its stringify function when using the arrayFormat 'comma'. If an array element has a non-callable own toString property, qs.stringify throws an uncaught TypeError. This can be triggered remotely by an unauthenticated attacker controlling input that is later serialized with this option, potentially crashing the Node.js process and causing a denial of service. There is no impact on confidentiality or integrity, and no prototype pollution occurs.