SB20261109197 - Uncaught Exception in qs

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109197

SB20261109197 - Uncaught Exception in qs

Published: November 9, 2026

Security Bulletin ID SB20261109197
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Partial DoS

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Uncaught Exception (CVE-ID: CVE-2026-110816)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote unauthenticated attacker to cause denial of service by crashing a worker process.

The vulnerability exists due to uncaught string coercion errors in qs.stringify when the non-default arrayFormat: 'comma' setting processes array elements without a callable toString. A remote unauthenticated attacker can submit an object containing such an element for application serialization, triggering an exception that terminates the process if no synchronous error boundary is present.


Remediation

Install update from vendor's website.

References