CVE-2026-8723: qs Library DoS Vulnerability

CVE-2026-8723 Overview

CVE-2026-8723 is a null pointer dereference vulnerability [CWE-476] in the qs query string library for Node.js. The flaw occurs in qs.stringify when called with both arrayFormat: 'comma' and encodeValuesOnly: true on an array containing null or undefined elements. The function throws a synchronous TypeError instead of returning a query string, bypassing the skipNulls and strictNullHandling options entirely. Affected versions span >=6.11.1 <6.15.2, with the fix released in v6.15.2.

Critical Impact

Applications calling qs.stringify with the vulnerable option combination on arrays containing null or undefined throw synchronously, returning HTTP 500 responses in framework-handled requests or terminating workers in unhandled contexts.

Affected Products

• qs Node.js library versions >=6.11.1 <6.15.2
• Node.js applications using arrayFormat: 'comma' with encodeValuesOnly: true
• Downstream frameworks and packages depending on vulnerable qs versions

Discovery Timeline

• 2026-05-17 - CVE-2026-8723 published to NVD
• 2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-8723

Vulnerability Analysis

The vulnerability resides in lib/stringify.js at line 145, within the comma-format encoding branch. When encodeValuesOnly is enabled, the code maps array elements through the raw encoder before joining them into a comma-separated string. The encoder function in lib/utils.js at line 195 reads str.length without a null guard, causing a TypeError when it encounters a null or undefined array element.

The skipNulls and strictNullHandling options are evaluated in a per-element loop that executes after the encoder map. Because the throw happens during the mapping step, neither null-handling option ever runs. This is the same class of bug previously fixed in the filter-array path (commit 0c180a4).

The vulnerable code shape was introduced in commit 4c4b23d ("encode comma values more consistently", PR #463) and first shipped in v6.11.1. Earlier versions (6.7.x through 6.11.0) joined array elements before encoding and are not affected.

Root Cause

The utils.encode function dereferences str.length on its input without first checking for null or undefined. The maybeMap helper applies the encoder to every element of the array, including null-valued entries, before the main loop has a chance to apply the configured null-handling policy.

Attack Vector

An attacker supplies a JSON request body containing an array with a null element to an endpoint that subsequently passes the parsed data to qs.stringify with the vulnerable option combination. The synchronous throw produces a denial-of-service condition for the affected request. Standard HTML form submissions cannot trigger this path because they produce strings or omitted fields rather than literal null values.

// Proof of concept from the security advisory
const qs = require('qs');

qs.stringify({ a: [null, 'b'] },      { arrayFormat: 'comma', encodeValuesOnly: true });
qs.stringify({ a: [undefined, 'b'] }, { arrayFormat: 'comma', encodeValuesOnly: true });
qs.stringify({ a: [null] },           { arrayFormat: 'comma', encodeValuesOnly: true });
// TypeError: Cannot read properties of null (reading 'length')
//     at encode (lib/utils.js:195:13)
//     at Object.maybeMap (lib/utils.js:322:37)
//     at stringify (lib/stringify.js:145:25)

Source: GitHub Security Advisory GHSA-q8mj-m7cp-5q26

Detection Methods for CVE-2026-8723

Indicators of Compromise

• Repeated HTTP 500 responses originating from request handlers that invoke qs.stringify
• Stack traces referencing lib/utils.js:195 and lib/stringify.js:145 with TypeError: Cannot read properties of null (reading 'length')
• Worker process restarts in background jobs, startup scripts, or stream pipelines that call qs.stringify outside a framework error boundary

Detection Strategies

• Audit package-lock.json and yarn.lock files for qs versions in the range >=6.11.1 <6.15.2
• Run npm ls qs to enumerate transitive dependencies pinning a vulnerable version
• Use Software Composition Analysis (SCA) tools to flag the GitHub Security Advisory GHSA-q8mj-m7cp-5q26
• Static analysis to identify call sites using both arrayFormat: 'comma' and encodeValuesOnly: true

Monitoring Recommendations

• Track 5xx error rates and correlate against deploys of services that depend on qs
• Aggregate Node.js uncaught exception telemetry for TypeError events matching the vulnerable stack frames
• Alert on background job failure spikes that match the qs.stringify call signature

How to Mitigate CVE-2026-8723

Immediate Actions Required

• Upgrade qs to v6.15.2 or later across all direct and transitive dependencies
• Rebuild and redeploy affected Node.js services after lockfile regeneration
• Inventory call sites passing user-controlled arrays into qs.stringify with the vulnerable option combination

Patch Information

The fix landed in commit 21f80b3 on the main branch and was released as v6.15.2. The patch wraps the encoder in a closure that passes null and undefined through unchanged, allowing the existing skipNulls and strictNullHandling logic in the main loop to handle them correctly.

// Patch from lib/stringify.js (line 145)
if (generateArrayPrefix === 'comma' && isArray(obj)) {
    // we need to join elements in
    if (encodeValuesOnly && encoder) {
-       obj = utils.maybeMap(obj, encoder);
+       obj = utils.maybeMap(obj, function (v) {
+           return v == null ? v : encoder(v);
+       });
    }
    objKeys = [{ value: obj.length > 0 ? obj.join(',') || null : void undefined }];
} else if (isArray(filter)) {

Source: GitHub Commit 21f80b3

Workarounds

• Sanitize input arrays to remove null and undefined entries before calling qs.stringify
• Avoid combining arrayFormat: 'comma' with encodeValuesOnly: true, or set encodeValuesOnly: false to use the unaffected encoding path
• Wrap qs.stringify calls in try/catch blocks when used outside framework error boundaries (background jobs, startup paths, stream pipelines)

# Upgrade qs to the patched version
npm install qs@^6.15.2

# Verify resolved version across the dependency tree
npm ls qs

# Regenerate lockfile and audit
npm audit fix