qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-110910 · Microsoft / collected KEV context

cve-program · CVE-2026-110910

• https://github.com/ljharb/qs/security/advisories/GHSA-w4cr-vjpx-p82q
• https://github.com/ljharb/qs/commit/234d5051f5071efaa025a7ca9e4d34a56a460a1b
• https://github.com/ljharb/qs/commit/6b8bf1a53d7b0c5e7e434eaae8e2c0cffd5c2492
• https://github.com/ljharb/qs/commit/033526fc82f2e80a3d896df2bce9137e34cb5dc5
• https://github.com/ljharb/qs/commit/f9dd4830cb922363822cdfdca2cceb3ed9792224
• https://github.com/ljharb/qs/commit/ad445aa23e4c3a97394c3b9a5f9d7a7159eb1f17
• https://github.com/ljharb/qs/commit/5d3b1b9ec6afd0cfc760c8e12862873789a32fc8
• https://github.com/ljharb/qs/pull/561
• https://github.com/ljharb/qs/issues/626

• qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection · Newly collected advisory · 27 Oct 2026
• qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection · Affected-version evidence changed · 27 Oct 2026