GHSA-q8mj-m7cp-5q26
Medium · 5.3CVSS
5.3
EPSS
—
Published
May 22, 2026
CISA due date
—
The record
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | qs | 6.11.1 | 6.15.2 |
Related vulnerabilities
- CVE-2026-8723 ### Summary `qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and… Same vulnerability
- GHSA-6rw7-vpxm-498p qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion Also affects qs
- CVE-2025-15284 Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue… Also affects qs
- CVE-2026-112405 Pillow is a Python imaging library. CWE-476
- CVE-2026-112392 Pillow is a Python imaging library. CWE-476
- CVE-2026-100348 kin-openapi is a Go project for handling OpenAPI files. CWE-476
- CVE-2026-100349 kin-openapi is a Go project for handling OpenAPI files. CWE-476
- CVE-2026-109280 ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx… CWE-476