PT-2026-41469 · Npm · Qs
CVSS v4.0
6.3
Medium
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
qs versions 6.11.1 through 6.15.1
Description
The
stringify() function throws a TypeError when called with the options arrayFormat: 'comma' and encodeValuesOnly: true on an array containing null or undefined elements. This occurs because the encode() function in lib/utils.js attempts to read the length property of the element without a null guard, bypassing null-related options such as skipNulls and strictNullHandling.In typical Node.js HTTP frameworks, this synchronous throw is caught by error boundaries, resulting in a 500 error for the affected request. However, if called outside a request-handler error boundary, such as in background jobs or startup paths, it may cause the worker process to exit.
Recommendations
Update to version 6.15.2.
As a temporary workaround, avoid using the
arrayFormat: 'comma' and encodeValuesOnly: true options simultaneously when processing arrays that may contain null or undefined values.Exploit
Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Qs