CVE ID :CVE-2026-8723<\/p>\n
Published : May 17, 2026, 12:16 a.m. | 1\u00a0hour, 41\u00a0minutes ago<\/p>\n
Description :### Summary<\/p>\n
`qs.stringify` throws `TypeError` when called with `arrayFormat: ‘comma’` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs’s null-related options (`skipNulls`, `strictNullHandling`).<\/p>\n
### Details<\/p>\n
In the comma + `encodeValuesOnly` branch, `lib\/stringify.js:145` mapped the array through the raw encoder before joining:<\/p>\n
“`js<\/p>\n
obj = utils.maybeMap(obj, encoder);<\/p>\n
“`<\/p>\n
`utils.encode` (`lib\/utils.js:195`) reads `str.length` with no null guard, so a `null` or `undefined` element throws `TypeError`. `skipNulls` and `strictNullHandling` are both checked in the per-element loop below this line and never get a chance to run.<\/p>\n
Same class of bug as the filter-array path fixed in 0c180a4. The vulnerable shape of the comma + `encodeValuesOnly` branch was introduced in 4c4b23d (“encode comma values more consistently”, PR #463, 2023-01-19), first released in v6.11.1.<\/p>\n
#### PoC<\/p>\n
“`js<\/p>\n
const qs = require(‘qs’);<\/p>\n
qs.stringify({ a: [null, ‘b’] }, { arrayFormat: ‘comma’, encodeValuesOnly: true });<\/p>\n
qs.stringify({ a: [undefined, ‘b’] }, { arrayFormat: ‘comma’, encodeValuesOnly: true });<\/p>\n
qs.stringify({ a: [null] }, { arrayFormat: ‘comma’, encodeValuesOnly: true });<\/p>\n
\/\/ TypeError: Cannot read properties of null (reading ‘length’)<\/p>\n
\/\/ at encode (lib\/utils.js:195:13)<\/p>\n
\/\/ at Object.maybeMap (lib\/utils.js:322:37)<\/p>\n
\/\/ at stringify (lib\/stringify.js:145:25)<\/p>\n
“`<\/p>\n
#### Fix<\/p>\n
`lib\/stringify.js:145`, applied in 21f80b3 on `main` and released as v6.15.2:<\/p>\n
“`diff<\/p>\n
– obj = utils.maybeMap(obj, encoder);<\/p>\n
+ obj = utils.maybeMap(obj, function (v) {<\/p>\n
+ return v == null ? v : encoder(v);<\/p>\n
+ });<\/p>\n
“`<\/p>\n
`null` and `undefined` now pass through `maybeMap` unchanged and reach the `join(‘,’)` step as-is. For `{ a: [null, ‘b’] }` this produces `a=,b`, matching the non-`encodeValuesOnly` comma path (which already joins before encoding and produces `a=%2Cb` for the same input). Single-element `[null]` arrays still collapse via the existing `obj.join(‘,’) || null` and remain subject to `skipNulls` \/ `strictNullHandling` in the main loop.<\/p>\n
### Affected versions<\/p>\n
`>=6.11.1
\n Severity: 6.3 | MEDIUM<\/p>\n
Visit the link for more details, such as CVSS details, affected products, timeline, and more…\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"
CVE ID :CVE-2026-8723 Published : May 17, 2026, 12:16 a.m. | 1\u00a0hour, 41\u00a0minutes ago Description :### Summary `qs.stringify` throws `TypeError` when called with `arrayFormat: ‘comma’` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs’s null-related options (`skipNulls`, `strictNullHandling`). ### Details In the comma …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-78544","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/78544","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=78544"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/78544\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=78544"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=78544"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=78544"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}