Query String Manipulation Vulnerability in qS Library by Node.js

CVE-2026-110910

What is CVE-2026-110910?

A vulnerability in the qS library allows for query string injection due to improper handling of empty array keys when using the 'allowEmptyArrays' option. When the library serializes objects with untrusted input as keys, it fails to encode certain characters in those keys, potentially allowing an attacker to inject additional parameters into the resulting query string. This vulnerability could lead to unexpected behavior in applications that process user inputs or JSON data, exposing them to risks such as data manipulation or exposure of sensitive information. The issue has been addressed in version 6.17.0, ensuring that empty array keys are treated consistently with other keys, enhancing the overall security of the library.

References