Improper Encoding or Escaping of Output Affecting qs package, versions >=6.12.0 <6.17.0
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-QS-21755395
- published27 Oct 2026
- disclosed27 Oct 2026
- creditDucMinhNe
Introduced: 27 Oct 2026
NewCVE-2026-110910 (opens in a new tab)How to fix?
Upgrade qs to version 6.17.0 or higher.
Overview
qs is a querystring parser that supports nesting and arrays, with a depth limit.
Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the stringify function when the allowEmptyArrays option is enabled. When an object key contains special characters (such as &, =, or #) and its value is an empty array, the key is returned without encoding, allowing an attacker who controls a key name to inject arbitrary query-string parameters or URL fragments into the serialized output. A consumer that parses the resulting string will see attacker-controlled key-value pairs that were not present in the original object.
PoC
var qs = require("qs");
var query = qs.stringify({ q: "hi", "x&apiKey=evil&y": [] }, { allowEmptyArrays: true });
// "q=hi&x&apiKey=evil&y[]"
qs.parse(query);
// { q: "hi", x: "", apiKey: "evil", y: [""] }
qs.stringify({ "x#": [], z: "1" }, { allowEmptyArrays: true });
// "x#[]&z=1": in a URL, everything after "#" becomes the fragment
Note: The PoC uses the qs npm package with the allowEmptyArrays option and states no specific runtime version or operating system.