qs CVE-2026-8723

Exploitation requires the target application to call qs.stringify with BOTH arrayFormat: 'comma' AND encodeValuesOnly: true options simultaneously - both are non-default and must be explicitly configured by developers. The input data passed to stringify must contain an array with at least one null or undefined element. This vulnerability is reachable from JSON request bodies in REST APIs (application/json content type) or from application code that constructs arrays from user input, but NOT from standard HTML form submissions which produce string values or omitted fields rather than literal null. Attack vector is network (AV:N) with no authentication required (PR:N based on CVSS vector), but attack technique is present (AT:P) due to the dual configuration requirement. Limits on exploitation: the synchronous throw is typically caught by Node.js framework error boundaries (Express, Fastify, Koa, hapi), returning HTTP 500 for the affected request without terminating the worker process, so impact is limited to denial of service for individual requests rather than full application crash in standard web application deployments.

Real-world risk is moderate and context-dependent. CVSS 4.0 score of 6.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VA:L) correctly reflects network accessibility with low complexity but limited availability impact - the attack complexity metric AT:P (Attack Complexity: Present) captures the requirement for two non-default options to be enabled simultaneously. No EPSS score, KEV listing, or SSVC data provided, but GitHub commit evidence confirms vendor patch released February 2025 in v6.15.2. The vulnerability requires application code to use both arrayFormat: 'comma' AND encodeValuesOnly: true together - both are non-default settings that must be explicitly configured. Standard HTML form submissions cannot trigger this (forms produce strings, not null values), limiting the attack surface to JSON APIs or code constructing arrays from parsed user input. In typical Node.js web frameworks (Express, Fastify, Koa, hapi), the synchronous throw is caught by framework error boundaries and returns HTTP 500 to the affected request without killing the worker process - subsequent requests continue normally. The 'process crash' scenario only applies to call sites outside request handlers (background jobs, startup paths, stream pipelines) or deployments that explicitly disable framework error handling. Given the narrow configuration requirements and automatic recovery in common deployments, this is lower priority than the CVSS score alone suggests, though teams using comma+encodeValuesOnly together should patch immediately.

An attacker sends a crafted JSON POST request to an API endpoint that uses qs.stringify with arrayFormat: 'comma' and encodeValuesOnly: true to serialize response data. The JSON payload includes an array parameter with a null element, for example {"filters": [null, "active"]}. When the application processes this input and passes the deserialized object to qs.stringify, the library throws an uncaught TypeError. The web framework's error boundary catches the exception and returns HTTP 500 to the attacker, confirming the vulnerability. The attacker can repeatedly trigger 500 errors for affected endpoints, causing denial of service for legitimate users of those API routes. Proof-of-concept code is available in the GitHub security advisory demonstrating the exact throw condition.