CVE-2026-110816: Denial of Service via Uncaught Exception in Node.js qs Library

Vulnerability ID: CVE-2026-110816

CVSS Score: 5.3

Published: 2026-10-27

CVE-2026-110816 (GHSA-6pq8-jhm2-2vcw) is an uncaught exception and improper type conversion vulnerability in the Node.js query string parsing and serialization library qs. When invoking qs.stringify with the option arrayFormat set to 'comma', the library fails to safely handle array elements that cannot be coerced into primitive strings, such as objects with a non-callable toString property or null-prototype objects.…