NULL pointer dereference in qs - CVE-2026-8723

Vulnerability identifier: #VU131746

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-8723

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to null pointer dereference in qs.stringify when processing arrays with comma format and encodeValuesOnly enabled. A remote attacker can supply input containing null or undefined array elements to cause a denial of service.

In typical Node.js HTTP frameworks, the synchronous exception usually causes the affected request to return an error rather than terminating the worker process. The vulnerable input is reachable from JSON request bodies or from application code constructing arrays from user input.

qs
IBM Cloud Transformation Advisor
PowerVC
Automation Assets in IBM Cloud Pak for Integration (CP4I)
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Decision Optimization for Cloud Pak for Data
IBM App Connect Enterprise
Platform Navigator in IBM Cloud Pak for Integration (CP4I)
MongoDB Enterprise Advanced with IBM
QRadar Threat Intelligence
Application Modernization Accelerator

Install security update from vendor's website.

qs - update to 6.15.2
IBM Cloud Transformation Advisor - update to 5.0.0
Automation Assets in IBM Cloud Pak for Integration (CP4I) - addressed in versions 4.0.23-sc2, 4.4.0
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.2
IBM App Connect Enterprise - addressed in versions 12.0.12.27, 13.0.8.0
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - addressed in versions 16.1.0.26, 16.2.0
MongoDB Enterprise Advanced with IBM - update to 1.49.7
QRadar Threat Intelligence - update to 2.6.0
Application Modernization Accelerator - update to 5.0.0
IBM Decision Optimization for Cloud Pak for Data - update to 5.3.1 patch 6

• https://github.com/ljharb/qs/security/advisories/GHSA-q8mj-m7cp-5q26
• https://github.com/ljharb/qs/commit/21f80b33e5c8b3f7eba1034fff0da4a4a37a1d41

• NULL pointer dereference in qs
• IBM Watson Discovery Cartridge update for qs
• Multiple vulnerabilities in IBM Decision Optimization for Cloud Pak for Data
• Platform Navigator and Automation Assets in IBM Cloud Pak for Integration update for qs
• Multiple vulnerabilities in IBM Application Modernization Accelerator
• Multiple vulnerabilities in IBM Transformation Advisor
• IBM PowerVC update for QS.stringify
• Multiple vulnerabilities in IBM App Connect Enterprise
• MongoDB Enterprise Advanced with IBM update for qs
• Multiple vulnerabilities in IBM QRadar Threat Intelligence