CVE-2026-110910

A flaw was found in qs. When the library is configured to allow empty arrays during query string serialization, it fails to encode object keys that contain empty array values. A remote attacker who can provide untrusted input key names can exploit this flaw by supplying keys containing query delimiter characters, resulting in parameter injection or query string truncation when data is forwarded to downstream services.

A flaw was found in the qs.stringify function of the qs package. When configured with allowEmptyArrays: true, the serializer fails to encode object keys associated with empty array values. A remote attacker supplying untrusted key names containing query delimiter characters (&, =, #) can exploit this behavior to inject arbitrary query parameters or truncate serialized query strings forwarded to downstream services.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Ensure allowEmptyArrays remains set to its default value (false) when serializing objects derived from untrusted input. If empty array support is required, sanitize or validate object keys prior to serialization to reject or escape URL delimiter characters (&, =, #).