Most recent entries from all

fkie_cve-2026-110816

### Summary

`qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ "toString": "x" }`) or a null-prototype object. The comma format joins array elements with `Array.prototype.join` and, under `encodeValuesOnly`, first passes each element through `String()` in `utils.encode`; neither guards against an element whose string coercion fails.

### Details

In `lib/stringify.js`, the comma branch collapses the array with `obj.join(',')`. For an element whose own `toString` is not callable, `ToPrimitive` skips it, falls through to `Object.prototype.valueOf` (which returns the object itself), and throws. Under `encodeValuesOnly: true`, the same element first reaches `String(str)` in `utils.encode` (`lib/utils.js`) and throws there. Nested arrays (`{ "a": [[{ "toString": "x" }]] }`) throw the same way, through `Array.prototype.toString`. The `indices`, `brackets`, and `repeat` formats walk into object elements instead of coercing them, and are not affected.

Such elements can come from untrusted input. `JSON.parse` produces `{ "a": [{ "toString": "x" }] }` with no qs option involved. `qs.parse("a[0][toString]=x", { allowPrototypes: true })` keeps the `toString` key, and `qs.parse("a[][b]=c", { plainObjects: true })` produces a null-prototype element; the default parse options drop `toString` and produce ordinary object…

msrc_CVE-2026-110816 — qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a string

msrc_CVE-2026-110816

RHSA-2026:85266 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

github.com/go-openapi/swag: go-openapi/swag: Denial of Service via uncontrolled JSON recursion github.com/getkin/kin-openapi: kin-openapi: Denial of Service via unsupported HTTP methods on static paths github.com/getkin/kin-openapi: kin-openapi: Denial of Service via self-referential schema definitions github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil pointer dereference in response validation github.com/getkin/kin-openapi: kin-openapi: Authentication bypass via URL path decoding discrepancy github.com/getkin/kin-openapi: kin-openapi: Denial of Service via improper handling of non-finite numeric values github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil-pointer dereference in request decoding github.com/getkin/kin-openapi: kin-openapi: Denial of Service via unbounded recursion during schema validation qs: qs: Denial of Service via unhandled exception during array serialization

UBUNTU-CVE-2026-110816

Affected: Ubuntu:Pro:14.04:LTS: node-qs, Ubuntu:16.04:LTS: node-qs, Ubuntu:18.04:LTS: node-qs, Ubuntu:Pro:20.04:LTS: node-qs, Ubuntu:22.04:LTS: node-qs, Ubuntu:24.04:LTS: node-qs, Ubuntu:26.10: node-qs, Ubuntu:26.04:LTS: node-qs

### Summary `qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ "toString": "x" }`) or a null-prototype object. The comma format joins array elements with `Array.prototype.join` and, under `encodeValuesOnly`, first passes each element through `String()` in `utils.encode`; neither guards against an element whose string coercion fails. ### Details In `lib/stringify.js`, the comma branch collapses the array with `obj.join(',')`. For an element whose own `toString` is not callable, `ToPrimitive` skips it, falls through to `Object.prototype.valueOf` (which returns the object itself), and throws. Under `encodeValuesOnly: true`, the same element first reaches `String(str)` in `utils.encode` (`lib/utils.js`) and throws there. Nested arrays (`{ "a": [[{ "toString": "x" }]] }`) throw the same way, through `Array.prototype.toString`. The `indices`, `brackets`, and `repeat` formats walk into object elements instead of coercing them, and are not affected. Such elements can come from untrusted input. `JSON.parse` produces `{ "a": [{ "toString": "x" }] }` with no qs option involved. `qs.parse("a[0][toString]=x", { allowPrototypes: true })` keeps the `toString` key, and `qs.parse("a[][b]=c", { plainObjects: true })` produces a null-prototype element; the default parse options drop `toString` and produce ordinary objects, which do…