{"id":"ghsa-ghsa-6pq8-jhm2-2vcw","seq":1708771,"kind":"advisory","title":"qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)","url":"https://github.com/advisories/GHSA-6pq8-jhm2-2vcw","permalink":"https://vulnpulse.app/items/ghsa-ghsa-6pq8-jhm2-2vcw","summary":"影響: npm:qs >= 6.7.0, <= 6.16.0 → 6.16.1\nqs.stringify(obj, { arrayFormat: 'comma' }) throws an uncaught TypeError: Cannot convert object to primitive value when an array in obj contains an element that carries an own, non-callable toString property (for example { a: [ { toString: 'x' } ] }). A remote, unauthenticated attacker who can influence an object that the application later re-serializes with the comma array format triggers the throw. In a service that lacks a synchronous error boundary around the serialization call, the uncaugh…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-110816"],"tags":["GHSA-6pq8-jhm2-2vcw","qs"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T16:10:55.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}