TypeError in qs.stringify Method of QS Library for Node.js

CVE-2026-8723

What is CVE-2026-8723?

A TypeError occurs in the QS library when the stringify method is called with both 'arrayFormat: comma' and 'encodeValuesOnly: true' on arrays containing null or undefined values. This results in synchronous throwing of an error, leading to potential failure in request handling processes across Node.js frameworks like Express and Fastify. The issue emerges from an unguarded reference to the length property of null or undefined elements during array mapping. The vulnerability affects versions 6.11.1 to 6.15.1, with a fix introduced in version 6.15.2 to gracefully handle such cases without throwing errors.

References