Executive brief
The 'qs' library, a popular tool for parsing and formatting URL query strings in Node.js applications, contains a flaw that can cause an application to crash or return errors. When the library is configured to format arrays using commas and certain encoding settings, providing an empty or undefined value within an array triggers a technical error. This can be used by an attacker to cause a denial-of-service (DoS) by sending specially crafted data that crashes the request handler, potentially impacting service availability.
Technical details
A NULL pointer dereference (CWE-476) exists in the 'qs' library when calling `qs.stringify` with `arrayFormat: 'comma'` and `encodeValuesOnly: true`. The vulnerability occurs in `lib/utils.js` because the `encode` function attempts to read the `.length` property of array elements without a null guard. If an array contains `null` or `undefined`, a `TypeError` is thrown synchronously. While most Node.js frameworks catch synchronous errors within request handlers (resulting in a 500 error), this can still lead to denial-of-service in environments without robust error boundaries or in background tasks. The issue was introduced in version 6.11.1 and is fixed in version 6.15.2.
Affected products
- ljharb qs >= 6.11.1, <= 6.15.1
Timeline
- 2023-01-19: other: Vulnerable code introduced in PR #463
- 2026-05-16: patched: Fix applied in commit 21f80b3
- 2026-05-17: advisory: NVD publication date
- 2026-05-22: disclosed: GitHub Advisory published