CVE-2026-8723

A flaw was found in the qs library. When the qs.stringify function processes arrays containing null or undefined elements, and is configured with both arrayFormat: 'comma' and encodeValuesOnly: true, it can trigger a TypeError. This error causes the application to crash or return a 500 error, leading to a Denial of Service (DoS) for affected requests.

A flaw of moderate severity was found in the qs JavaScript query-string serialization library, which is shipped in a number of Red Hat products. When qs.stringify() is called with the non-default options arrayFormat: 'comma' and encodeValuesOnly: true on an array that contains a null or undefined element, the internal encoder reads the length property of the null value without a guard and throws a synchronous TypeError. A remote, unauthenticated attacker who can cause such input to reach a vulnerable call site, for example through a JSON request body or application code that constructs arrays from user input, can trigger this exception and cause the affected request to fail, typically with an HTTP 500 error, resulting in a limited denial of service affecting availability only. In typical Node.js HTTP frameworks the throw is caught by the framework's error boundary and only the individual request fails; process termination is possible only for call sites outside a request-handler error boundary, such as background jobs or startup paths. The requirement for both non-default options limits the number of exposed call sites, and standard HTML form submissions cannot produce the required null array elements. This matches the Red Hat severity of Moderate with CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), consistent with the upstream CVSS v3.1 assessment, with no confidentiality or integrity impact. All currently tracked Red Hat product streams for the qs component are recorded as affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.