CVE-2026-110816: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-110816 is a Denial of Service vulnerability in the qs npm package (by ljharb) where qs.stringify with arrayFormat: 'comma' throws an uncaught TypeError: Cannot convert object to primitive value when processing array elements that cannot be coerced to strings. Affected versions are >= 6.7.0 and <= 6.16.0; the vulnerability was introduced when the comma array format was added in v6.7.0. It was disclosed on October 14, 2026, and fixed in v6.16.1. The CVSS v3.1 base score is 5.3 (Medium) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-248 (Uncaught Exception) and CWE-704 (Incorrect Type Conversion or Cast). In lib/stringify.js, the comma branch collapses arrays using Array.prototype.join, which performs an implicit ToPrimitive string coercion on each element. When an element has an own non-callable toString property (e.g., { "toString": "x" } from JSON.parse) or is a null-prototype object (from qs.parse with plainObjects: true), JavaScript's ToPrimitive skips the non-callable toString, falls through to Object.prototype.valueOf (which returns the object itself, not a primitive), and throws. Under encodeValuesOnly: true, the same element reaches String(str) in lib/utils.js and throws there. Critically, attacker-controllable sources include JSON.parse of a request body (no special options needed), qs.parse with allowPrototypes: true (the default for Express 4, Express 5 extended parser, and body-parser's urlencoded({ extended: true })), and qs.parse with plainObjects: true (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation causes a synchronous, uncaught TypeError in any code path that re-serializes attacker-influenced data with qs.stringify and arrayFormat: 'comma'. In applications using a framework like Express with a synchronous error boundary, the affected request returns an HTTP 500 and the process survives. However, in applications without a synchronous error boundary — such as bare http.createServer handlers or async Express 4 handlers (where the throw becomes an unhandled promise rejection) — the process exits, taking the service offline. There is no confidentiality or integrity impact, no memory unsafety, and no prototype pollution (GitHub Advisory).

A public proof-of-concept is included in the GitHub Security Advisory itself, demonstrating the throw in isolation with a simple Node.js script. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is 0.00304 (approximately 0.3%), indicating low probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Identify a vulnerable target: Find a Node.js application using qs versions 6.7.0–6.16.0 that accepts untrusted input and subsequently calls qs.stringify with arrayFormat: 'comma' (e.g., to rebuild a query string for a redirect or upstream request).
2. Craft a malicious payload: Prepare input that will produce an array element with a non-callable toString property. This can be done via a JSON request body: {"a":[{"toString":"x"}]}, or via a query string a[0][toString]=x targeting an endpoint using Express 4/5 or body-parser (which parse with allowPrototypes: true).
3. Send the request: Submit the crafted payload to the vulnerable endpoint via an HTTP request (no authentication required).
4. Trigger the TypeError: When the application processes the input and calls qs.stringify(obj, { arrayFormat: 'comma' }), the Array.prototype.join or String() coercion on the hostile element throws TypeError: Cannot convert object to primitive value.
5. Achieve denial of service: If the application lacks a synchronous error boundary around the stringify call, the uncaught exception crashes the worker process (client sees ECONNRESET); under Express, the request fails with HTTP 500 (GitHub Advisory, Red Hat Bugzilla).

• Network: Repeated HTTP requests to endpoints that process query strings or JSON bodies, containing parameters like a[0][toString]=x or JSON payloads with {"toString": "x"} as array elements.
• Logs: Application error logs showing TypeError: Cannot convert object to primitive value originating from lib/stringify.js or lib/utils.js in the qs package; HTTP 500 responses correlated with specific request patterns.
• Process: Unexpected Node.js process exits or restarts (e.g., via process manager like PM2) without a clear application-level error, particularly in services without framework error boundaries; ECONNRESET errors on the client side coinciding with process crashes.

Upgrade the qs package to version 6.16.1 or later, which applies the fix from commit a952e75 that defensively coerces non-stringifiable elements to their valueOf primitive or falls back to Object.prototype.toString (GitHub Commit). As interim mitigations without a code change: avoid using arrayFormat: 'comma' when serializing data derived from untrusted input; sanitize parsed objects by avoiding allowPrototypes: true or plainObjects: true on untrusted input and stripping unexpected own properties; and wrap qs.stringify calls in a synchronous try/catch error boundary to prevent unhandled exceptions from crashing the process (GitHub Advisory).

The vulnerability was reported by researchers @manus-pi (GitHub: zx) and independently by @Lucidsec, both credited in the GitHub Security Advisory. Red Hat has tracked the issue via Bugzilla (Bug 2552954) and published a CVE advisory. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability tracking platforms (GitHub Advisory, Red Hat Bugzilla).