Ljharb Qs vulnerabilities
- ljharb qs qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection 6.3 Medium
- ljharb qs qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a string 6.3 Medium
- ljharb qs qs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391) 6.3 Medium
- ljharb qs qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property 6.3 Medium
- ljharb qs qs.stringify crashes on null/undefined entries in comma-format arrays under encodeValuesOnly 6.3 Medium