Description
### Summary



`qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ "toString": "x" }`) or a null-prototype object. The comma format joins array elements with `Array.prototype.join` and, under `encodeValuesOnly`, first passes each element through `String()` in `utils.encode`; neither guards against an element whose string coercion fails.



### Details



In `lib/stringify.js`, the comma branch collapses the array with `obj.join(',')`. For an element whose own `toString` is not callable, `ToPrimitive` skips it, falls through to `Object.prototype.valueOf` (which returns the object itself), and throws. Under `encodeValuesOnly: true`, the same element first reaches `String(str)` in `utils.encode` (`lib/utils.js`) and throws there. Nested arrays (`{ "a": [[{ "toString": "x" }]] }`) throw the same way, through `Array.prototype.toString`. The `indices`, `brackets`, and `repeat` formats walk into object elements instead of coercing them, and are not affected.



Such elements can come from untrusted input. `JSON.parse` produces `{ "a": [{ "toString": "x" }] }` with no qs option involved. `qs.parse("a[0][toString]=x", { allowPrototypes: true })` keeps the `toString` key, and `qs.parse("a[][b]=c", { plainObjects: true })` produces a null-prototype element; the default parse options drop `toString` and produce ordinary objects, which do not throw. Express 4's default `query parser`, Express 5's `extended` query parser, and body-parser's `urlencoded({ extended: true })` all call `qs.parse` with `allowPrototypes: true`.



#### PoC



```js



var qs = require("qs");



qs.stringify(JSON.parse("{\"a\":[{\"toString\":\"x\"}]}"), { arrayFormat: "comma" });



qs.stringify(qs.parse("a[0][toString]=x", { allowPrototypes: true }), { arrayFormat: "comma" });



qs.stringify(qs.parse("a[][b]=c", { plainObjects: true }), { arrayFormat: "comma", encodeValuesOnly: true });



// TypeError: Cannot convert object to primitive value



```



#### Fix



Applied in a952e75 on `main` and released as v6.16.1: an element whose string coercion would fail is coerced to its primitive `valueOf`, if any, or else to `Object.prototype.toString`, so it renders as `[object Object]`, the same as any other object element already does under the comma format. Nested arrays are walked the way `join` walks them. Every input that did not previously throw serializes exactly as before, and a `toString` or `valueOf` that itself throws still propagates.



### Affected versions



`>=6.7.0 <6.16.1`, fixed in v6.16.1.



The `join` path was introduced with the comma format in b84acba and first shipped in v6.7.0; v6.6.x and earlier ignore `arrayFormat: 'comma'` and are not affected. The `encodeValuesOnly` `String()` site was introduced in 4c4b23d (v6.11.1); before that, the same input throws at `join`. Every release from v6.7.0 through v6.16.0 is affected.



### Impact



An unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` and `arrayFormat: 'comma'` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a bare `http` request handler, the process exits, so the impact in that case depends on the application error handling rather than on qs. The default `arrayFormat` (`indices`) is not affected.
Published: 2026-10-14
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

The library qs uses arrayFormat 'comma' to join array elements with Array.prototype.join. When an element has a non‑callable toString, string conversion can fail, causing a TypeError that propagates out of qs.stringify. This synchronous failure interrupts any code that re‑serializes attacker‑controlled data—such as rebuilding query strings, forwarding data to upstream services, or serializing parsed JSON—resulting in an HTTP 500 error or, if unhandled, a process exit. The flaw enables denial of service but not code execution, and maps to CWE-248 (Incorrect Type Conversion) and CWE-704 (Incorrect Type Conversion).

Affected Systems

The vulnerability exists in the Node.js query string library qs, maintained by ljharb. Versions from 6.7.0 through 6.16.0 are affected; earlier 6.6.x releases and any version older than 6.7.0 are not impacted. Because qs is widely used by Express (4 and 5), body-parser and other Node frameworks, any application that pulls in an affected qs release and uses arrayFormat: 'comma' is potentially vulnerable.

Risk and Exploitability

The CVSS score is 6.3 (medium), the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the fault by sending a crafted URL or request body that includes an array element with an invalid toString, such as ?a[0][toString]=x or a JSON body that parses to an object whose toString property is a string. In many frameworks the error is caught and results in a 500 response; in others the exception propagates as an unhandled promise rejection or directly crashes a bare http handler. This makes the risk moderate, limited to loss of availability in the affected request path and dependent on the application’s error handling.

Generated by OpenCVE AI on October 15, 2026 at 12:31 UTC.

Remediation

Vendor Solution

Upgrade to qs 6.16.1 or later.

Vendor Workaround

Use the default `arrayFormat` (`indices`), or pass a `filter` function to `qs.stringify` that replaces non-primitive array elements before the comma format joins them. Alternatively, wrap `qs.stringify` calls on externally influenced objects in try/catch, and avoid `allowPrototypes: true` / `plainObjects: true` when parsed untrusted input is fed back into `qs.stringify`.

OpenCVE Recommended Actions

  • Upgrade qs to version 6.16.1 or later.
  • If an upgrade is not immediately possible, avoid using arrayFormat: 'comma'—use the default 'indices' format or supply a filter function that replaces non‑primitive array elements before stringification.
  • Wrap qs.stringify calls that process externally supplied data in a try/catch block, and when parsing input, avoid allowPrototypes:true or plainObjects:true if the data is sourced from untrusted origins.

Generated by OpenCVE AI on October 15, 2026 at 12:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 14 Oct 2026 22:15:00 +0000

Type Values Removed Values Added
Description ### Summary `qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ "toString": "x" }`) or a null-prototype object. The comma format joins array elements with `Array.prototype.join` and, under `encodeValuesOnly`, first passes each element through `String()` in `utils.encode`; neither guards against an element whose string coercion fails. ### Details In `lib/stringify.js`, the comma branch collapses the array with `obj.join(',')`. For an element whose own `toString` is not callable, `ToPrimitive` skips it, falls through to `Object.prototype.valueOf` (which returns the object itself), and throws. Under `encodeValuesOnly: true`, the same element first reaches `String(str)` in `utils.encode` (`lib/utils.js`) and throws there. Nested arrays (`{ "a": [[{ "toString": "x" }]] }`) throw the same way, through `Array.prototype.toString`. The `indices`, `brackets`, and `repeat` formats walk into object elements instead of coercing them, and are not affected. Such elements can come from untrusted input. `JSON.parse` produces `{ "a": [{ "toString": "x" }] }` with no qs option involved. `qs.parse("a[0][toString]=x", { allowPrototypes: true })` keeps the `toString` key, and `qs.parse("a[][b]=c", { plainObjects: true })` produces a null-prototype element; the default parse options drop `toString` and produce ordinary objects, which do not throw. Express 4's default `query parser`, Express 5's `extended` query parser, and body-parser's `urlencoded({ extended: true })` all call `qs.parse` with `allowPrototypes: true`. #### PoC ```js var qs = require("qs"); qs.stringify(JSON.parse("{\"a\":[{\"toString\":\"x\"}]}"), { arrayFormat: "comma" }); qs.stringify(qs.parse("a[0][toString]=x", { allowPrototypes: true }), { arrayFormat: "comma" }); qs.stringify(qs.parse("a[][b]=c", { plainObjects: true }), { arrayFormat: "comma", encodeValuesOnly: true }); // TypeError: Cannot convert object to primitive value ``` #### Fix Applied in a952e75 on `main` and released as v6.16.1: an element whose string coercion would fail is coerced to its primitive `valueOf`, if any, or else to `Object.prototype.toString`, so it renders as `[object Object]`, the same as any other object element already does under the comma format. Nested arrays are walked the way `join` walks them. Every input that did not previously throw serializes exactly as before, and a `toString` or `valueOf` that itself throws still propagates. ### Affected versions `>=6.7.0 <6.16.1`, fixed in v6.16.1. The `join` path was introduced with the comma format in b84acba and first shipped in v6.7.0; v6.6.x and earlier ignore `arrayFormat: 'comma'` and are not affected. The `encodeValuesOnly` `String()` site was introduced in 4c4b23d (v6.11.1); before that, the same input throws at `join`. Every release from v6.7.0 through v6.16.0 is affected. ### Impact An unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` and `arrayFormat: 'comma'` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a bare `http` request handler, the process exits, so the impact in that case depends on the application error handling rather than on qs. The default `arrayFormat` (`indices`) is not affected.
Title qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a string
Weaknesses CWE-248
CWE-704
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: harborist

Published:

Updated: 2026-10-14T22:05:24.015Z

Reserved: 2026-10-14T21:40:55.805Z

Link: CVE-2026-110816

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-14T22:17:23.230

Modified: 2026-10-14T22:17:23.230

Link: CVE-2026-110816

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-14T22:05:24Z

Links: CVE-2026-110816 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-15T12:45:13Z

Weaknesses
  • CWE-248

    Uncaught Exception

  • CWE-704

    Incorrect Type Conversion or Cast