Note: Versions mentioned in the description apply only to the upstream dotnet-sdk-8.0-source-built-artifacts package and not the dotnet-sdk-8.0-source-built-artifacts package as distributed by RHEL. See How to fix? for RHEL:8 relevant fixed versions and status.

Summary

qs.stringify throws TypeError when called with arrayFormat: 'comma' and encodeValuesOnly: true on an array containing null or undefined. The throw is synchronous and not handled by any of qs's null-related options (skipNulls, strictNullHandling).

Details

In the comma + encodeValuesOnly branch, lib/stringify.js:145 mapped the array through the raw encoder before joining:




obj = utils.maybeMap(obj, encoder);

utils.encode (lib/utils.js:195) reads str.length with no null guard, so a null or undefined element throws TypeError. skipNulls and strictNullHandling are both checked in the per-element loop below this line and never get a chance to run.

Same class of bug as the filter-array path fixed in 0c180a4. The vulnerable shape of the comma + encodeValuesOnly branch was introduced in 4c4b23d ("encode comma values more consistently", PR #463, 2023-01-19), first released in v6.11.1.

PoC




const qs = require(&#39;qs&#39;);



qs.stringify({ a: [null, &#39;b&#39;] },      { arrayFormat: &#39;comma&#39;, encodeValuesOnly: true });



qs.stringify({ a: [undefined, &#39;b&#39;] }, { arrayFormat: &#39;comma&#39;, encodeValuesOnly: true });



qs.stringify({ a: [null] },           { arrayFormat: &#39;comma&#39;, encodeValuesOnly: true });



// TypeError: Cannot read properties of null (reading &#39;length&#39;)



//     at encode (lib/utils.js:195:13)



//     at Object.maybeMap (lib/utils.js:322:37)



//     at stringify (lib/stringify.js:145:25)

Fix

lib/stringify.js:145, applied in 21f80b3 on main and released as v6.15.2:




- obj = utils.maybeMap(obj, encoder);



+ obj = utils.maybeMap(obj, function (v) {



+     return v == null ? v : encoder(v);



+ });

null and undefined now pass through maybeMap unchanged and reach the join(',') step as-is. For { a: [null, 'b'] } this produces a=,b, matching the non-encodeValuesOnly comma path (which already joins before encoding and produces a=%2Cb for the same input). Single-element [null] arrays still collapse via the existing obj.join(',') || null and remain subject to skipNulls / strictNullHandling in the main loop.

Affected versions

>=6.11.1 <6.15.2 — fixed in v6.15.2.

The vulnerable code shape was introduced in 4c4b23d and first shipped in v6.11.1. Earlier versions — including all of 6.7.x, 6.8.x, 6.9.x, 6.10.x, and 6.11.0 — implemented the comma + encodeValuesOnly path differently (joining before encoding) and are not affected. Empirically verified across released versions.

Impact

Application code that calls qs.stringify with both arrayFormat: 'comma' and encodeValuesOnly: true (both non-default) on input that may contain a null or undefined array element will throw synchronously instead of producing a query string. In a typical Node.js HTTP framework (Express, Fastify, Koa, hapi) the sync throw is caught by the framework's error boundary and the affected request returns a 500; the worker process does not exit and subsequent requests are unaffected. The "kills the worker process" framing applies only to call sites outside a request-handler error boundary (background jobs, startup paths, stream pipelines) or to deployments with framework error handling explicitly disabled.

The vulnerable input is a null or undefined entry inside an array; this is reachable from JSON request bodies or from application code constructing arrays from user input, but not from standard HTML form submissions (which produce strings or omitted fields, not literal null).

Vulnerability	Vulnerable Version
H Weak Password Recovery Mechanism for Forgotten Password	*
H Authentication Bypass	*
M Information Exposure	*
H Improper Certificate Validation	*
H Incorrect Authorization	*
H Allocation of Resources Without Limits or Throttling	*
H Allocation of Resources Without Limits or Throttling	*
H Algorithmic Complexity	*
H Uncontrolled Recursion	*
H Incomplete Blacklist	*
H Arbitrary Code Injection	*
M Unchecked Input for Loop Condition	*
H Allocation of Resources Without Limits or Throttling	*
M Improper Validation of Specified Quantity in Input	*
H Loop with Unreachable Exit Condition ('Infinite Loop')	*
M Inappropriate Encoding for Output Context	*
M Improper Handling of Case Sensitivity	*
M Origin Validation Error	<0:8.0.131-1.el8_10
M NULL Pointer Dereference	*
H Reliance on Untrusted Inputs in a Security Decision	*
H Unchecked Return Value	<0:8.0.130-1.el8_10
H Unchecked Input for Loop Condition	<0:8.0.130-1.el8_10
H Improper Cross-boundary Removal of Sensitive Data	<0:8.0.130-1.el8_10
H HTTP Request Smuggling	<0:8.0.130-1.el8_10
H Inappropriate Encoding for Output Context	<0:8.0.129-1.el8_10
H Deserialization of Untrusted Data	<0:8.0.129-1.el8_10
H Allocation of Resources Without Limits or Throttling	<0:8.0.129-1.el8_10
H Allocation of Resources Without Limits or Throttling	<0:8.0.129-1.el8_10
H Allocation of Resources Without Limits or Throttling	<0:8.0.129-1.el8_10
H Reliance on Untrusted Inputs in a Security Decision	<0:8.0.129-1.el8_10
H Arbitrary Code Injection	<0:8.0.129-1.el8_10
H Improper Verification of Cryptographic Signature	<0:8.0.129-1.el8_10
H Incorrect Behavior Order: Authorization Before Parsing and Canonicalization	<0:8.0.129-1.el8_10
H Allocation of Resources Without Limits or Throttling	<0:8.0.129-1.el8_10
H Improper Validation of Specified Type of Input	<0:8.0.129-1.el8_10
H External Control of Assumed-Immutable Web Parameter	<0:8.0.129-1.el8_10
H Access of Resource Using Incompatible Type ('Type Confusion')	<0:8.0.129-1.el8_10
H Incorrect Implementation of Authentication Algorithm	<0:8.0.129-1.el8_10
H Buffer Overflow	<0:8.0.129-1.el8_10
H Link Following	<0:8.0.129-1.el8_10
H Allocation of Resources Without Limits or Throttling	<0:8.0.129-1.el8_10
M Allocation of Resources Without Limits or Throttling	*
H Allocation of Resources Without Limits or Throttling	<0:8.0.128-1.el8_10
H Link Following	<0:8.0.128-1.el8_10
H Loop with Unreachable Exit Condition ('Infinite Loop')	<0:8.0.127-1.el8_10
H Improper Neutralization of Special Elements	<0:8.0.126-1.el8_10
H Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')	<0:8.0.126-1.el8_10
H Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')	<0:8.0.126-1.el8_10
H Out-of-bounds Write	<0:8.0.126-1.el8_10
H Loop with Unreachable Exit Condition ('Infinite Loop')	<0:8.0.127-1.el8_10
H Allocation of Resources Without Limits or Throttling	<0:8.0.125-1.el8_10
H Insecure Temporary File	<0:8.0.121-1.el8_10
H Cleartext Transmission of Sensitive Information	<0:8.0.121-1.el8_10
H HTTP Request Smuggling	<0:8.0.121-1.el8_10
H Uncontrolled Search Path Element	<0:8.0.117-1.el8_10
H Authentication Bypass	<0:8.0.116-1.el8_10
H Improper Privilege Management	<0:8.0.114-1.el8_10
H Cross-site Scripting (XSS)	<0:8.0.112-1.el8_10
H Improper Restriction of Names for Files and Other Resources	<0:8.0.112-1.el8_10
H Creation of Temporary File in Directory with Incorrect Permissions	<0:8.0.112-1.el8_10
H Buffer Over-read	<0:8.0.112-1.el8_10
H Allocation of Resources Without Limits or Throttling	<0:8.0.110-1.el8_10
H Use After Free	<0:8.0.110-1.el8_10
H Algorithmic Complexity	<0:8.0.110-1.el8_10
H Algorithmic Complexity	<0:8.0.110-1.el8_10
M Information Exposure	<0:8.0.108-1.el8_10
H CVE-2024-38095	<0:8.0.107-1.el8_10
H CVE-2024-35264	<0:8.0.107-1.el8_10
H CVE-2024-30105	<0:8.0.107-1.el8_10
H Deadlock	<0:8.0.105-1.el8_10
H Out-of-Bounds	<0:8.0.105-1.el8_10
M Resource Exhaustion	<0:8.0.103-1.el8_9
H Resource Exhaustion	<0:8.0.102-2.el8_9
H CVE-2024-21386	<0:8.0.102-2.el8_9
H Improper Certificate Validation	<0:8.0.101-1.el8_9
H Unprotected Alternate Channel	<0:8.0.101-1.el8_9
H Resource Exhaustion	<0:8.0.101-1.el8_9
M CVE-2023-36558	<0:8.0.100-2.el8_9
M Arbitrary Code Injection	<0:8.0.100-2.el8_9

dotnet-sdk-8.0-source-built-artifacts

Direct Vulnerabilities

Fix vulnerabilities automatically