Uncaught Exception in qs - CVE-2026-110816
Published: November 9, 2026
Vulnerability identifier: #VU163100
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-110816
CWE-ID: CWE-248
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote unauthenticated attacker to cause denial of service by crashing a worker process.
The vulnerability exists due to uncaught string coercion errors in qs.stringify when the non-default arrayFormat: 'comma' setting processes array elements without a callable toString. A remote unauthenticated attacker can submit an object containing such an element for application serialization, triggering an exception that terminates the process if no synchronous error boundary is present.
Affected software
qs
How to mitigate CVE-2026-110816
Install security update from vendor's website.
qs - update to 6.16.1