qs vulnerabilities

A vulnerability in the qs library causes the key of an empty array to be written without encoding when allowEmptyArrays: true is used, even though keys are encoded by default. A key containing &, =, or # can therefore inject parameters into the serialized query string or truncate it. Affected versions are >=6.12.0 <6.12.6, >=6.13.0 <6.13.4, >=6.14.0 <6.14.3, >=6.15.0 <6.15.4, and >=6.16.0 <6.16.2.

A vulnerability in the qs library affects qs.stringify with arrayFormat: 'comma', which throws a TypeError when an array element cannot be coerced to a string (e.g., an object with an own non-callable toString or a null-prototype object). The issue exists in versions >=6.7.0 <6.16.1 and is fixed in v6.16.1. Input can come from untrusted sources, including JSON.parse or qs.parse with allowPrototypes: true.

A vulnerability in the qs library allows bypassing the arrayLimit for comma-separated values when comma: true and throwOnLimitExceeded: true are used. This affects bracket-push keys (a[]=), where the value is split into an array without checking the limit, enabling allocation of arbitrarily large arrays. The issue affects versions >=6.14.2 <6.16.0 and is fixed in 6.16.0.

The `qs.stringify` function in the qs library throws a `TypeError` when serializing an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. The duck-typing check in `utils.isBuffer` invokes `obj.constructor.isBuffer(obj)` without verifying it is a function, causing the error. Affected versions are from 2.2.5 to 6.15.3, fixed in 6.16.0.

The qs library versions 6.11.1 through 6.15.2 contain a bug where qs.stringify throws a synchronous TypeError when called with arrayFormat: 'comma' and encodeValuesOnly: true on an array containing null or undefined. The skipNulls and strictNullHandling options are not honored because the error occurs before they are checked. The vulnerability is fixed in version 6.15.2.

A vulnerability in the qs library (parse module) involves improper input validation — the arrayLimit option was not enforced for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This allows arrays larger than the defined limit to be created. The default parameterLimit (1000) effectively mitigates the practical impact.