CVE-2026-110816

Executive Summary

CVE-2026-110816 is a denial-of-service vulnerability in the qs library, a widely used Node.js querystring parsing and stringification module. When qs.stringify is invoked with the arrayFormat: 'comma' option and an array element cannot be coerced to a primitive string — such as an object with a non-callable toString property or a null-prototype object — the library throws a TypeError: Cannot convert object to primitive value. Because such elements can be introduced from untrusted input via JSON.parse or crafted query strings parsed with allowPrototypes or plainObjects, a remote attacker may be able to trigger an unhandled exception in applications that stringify attacker-influenced data using this configuration. The CVSS score is 5.3 (Medium), reflecting a network-reachable, low-complexity availability impact with no confidentiality or integrity loss. No public exploit or patch currently exists.

Technical Analysis

The qs library processes arrays in several configurable output formats. The comma format collapses an array into a single comma-separated value. Per the NVD description, in lib/stringify.js the comma branch performs obj.join(','). Array.prototype.join internally invokes each element's ToString abstract operation (via ToPrimitive with a string hint). If an element is an object whose own toString property is not callable — for example { "toString": "x" } — the coercion mechanism observes that the property is non-callable, skips it, falls through to Object.prototype.valueOf (which returns the object itself rather than a primitive), and ultimately throws TypeError: Cannot convert object to primitive value.

A second failure path exists under the encodeValuesOnly: true option. In that configuration, each element is first passed through String(str) within utils.encode (implemented in lib/utils.js). The same non-coercible element throws at this earlier stage rather than at the join call. Nested arrays, such as { "a": [[{ "toString": "x" }]] }, throw through Array.prototype.toString in the same manner.

The description explicitly notes that the indices, brackets, and repeat array formats "walk into object elements instead of coercing them, and are not affected." This confines the defect to the comma array format (and its intersection with encodeValuesOnly).

Attack surface relevance derives from the fact that the offending elements can originate from untrusted sources without any special qs option being applied at the stringify stage:

• JSON.parse reconstructs { "a": [{ "toString": "x" }] } from attacker-supplied JSON with no qs involvement, meaning any application that parses untrusted JSON and later stringifies it with the comma format is exposed.
• qs.parse("a[0][toString]=x", { allowPrototypes: true }) preserves the toString key so the resulting object element carries a non-callable toString value.
• qs.parse("a[][b]=c", { plainObjects: true }) produces a null-prototype element that likewise fails string coercion.
• The description also states that "the default parse options drop toString and produce ordinary objects," which constrains the parse-side trigger vectors to non-default configurations.

The root cause is therefore a failure to guard against array elements whose string coercion is not well-defined. The library assumes every element is coercible by join/String(), and does not validate or fall back when coercion throws.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for CVE-2026-110816. The following attack chain is inferred from the vulnerability class (CWE-248: Uncaught Exception) and the mechanisms documented in the NVD description.

1. Reconnaissance / target identification. An attacker identifies a target application that (a) uses the qs library, (b) stringifies data using arrayFormat: 'comma', and (b) processes attacker-influenceable input. Favorable indicators include APIs or services that accept structured input — JSON bodies, nested query strings — and reflect, forward, or persist that data after passing it through qs.stringify. Because qs is a common transitive dependency in Node.js/Express ecosystems, dependency discovery via package.json or software composition analysis output identifies candidate targets.

2. Trigger of the flaw class. The attacker supplies data engineered so that an array element is an object that cannot be coerced to a primitive string. Two contamination routes are documented:

   • Submit JSON containing { "a": [{ "toString": "x" }] }; when the application later stringifies this array with the comma format, the join/String() coercion path throws.
   • Submit query parameters such as a[0][toString]=x (viable only where the application parses with allowPrototypes: true) or a[][b]=c (viable where it parses with plainObjects: true, yielding a null-prototype element).

3. Payload / execution method at the vulnerability-class level. The payload does not require code execution primitives; it is a data-shape attack. The attacker needs only to place a non-coercible element into an array that the server subsequently stringifies under the vulnerable configuration. If the resulting TypeError is unhandled, it propagates as an uncaught exception. In Node.js, an uncaught synchronous exception in a request handler typically terminates the affected process or drops the request depending on the server framework and error-handling middleware.

4. Post-exploitation impact. The expected outcome is an unhandled exception leading to availability degradation — request failure or process termination — consistent with the CVSS availability-only impact (A:L). Depending on deployment topology (single-process versus clustered, with or without a supervisor such as systemd or pm2 that restarts workers), repeated delivery of the payload could induce sustained or repeated service disruption. There is no documented confidentiality or integrity impact, and no described path to code execution.

No evidence of exploitation in the wild, threat-actor association, or CISA KEV listing exists for this CVE at the time of writing. The exploit chain should be treated as theoretical until a public PoC or vendor confirmation appears.

Impact Assessment

The CVSS v3.1 base score is 5.3 (Medium), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. The subscores indicate:

• AV:N (Network) — the vulnerable code is reachable over a network interface; exploitation does not require local access.
• AC:L (Low) — no special conditions or race windows are required beyond the vulnerable configuration being present.
• PR:N (None) — no authentication is required to supply the triggering input.
• UI:N (None) — no user interaction is needed.
• S:U (Unchanged) — the impact remains within the vulnerable component's security scope.
• C:N / I:N — no confidentiality or integrity impact is demonstrated.
• A:L (Low) — availability impact is limited, consistent with a single request failure or short-lived process exception rather than total, permanent loss of service.

Affected systems are Node.js applications and services that use qs with arrayFormat: 'comma' (optionally with encodeValuesOnly: true) and process untrusted input. Blast radius depends on configuration exposure: the parse-side vectors require the non-default allowPrototypes or plainObjects options, whereas the JSON.parse route requires no special qs configuration at the parse stage. The impact is bounded to availability; there is no data-exfiltration or tampering effect in the supplied data.

Detection Guidance

Sigma Rule

title: qs stringify comma arrayFormat Type Coercion Denial of Service
id: 4f2b8c1a-9d3e-4a7c-8b21-qscomma-001
status: experimental
description: Detects exceptions or errors originating from qs stringify when arrayFormat comma coerces non-primitive array elements (CVE-2026-110816).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110816
author: Threat Intelligence
logsource:
  category: application
  product: nodejs
detection:
  selection_error:
    message|contains:
      - 'Cannot convert object to primitive value'
  selection_module:
    message|contains:
      - 'qs'
      - 'stringify'
  condition: selection_error and selection_module
falsepositives:
  - Other libraries or user code that throw the same TypeError text
level: medium
tags:
  - attack.t1499
  - cwe.248

YARA Rule

rule CVE_2026_110816_qs_comma_coercion
{
    meta:
        description = "Detects references to qs stringify comma arrayFormat and non-callable toString coercion patterns linked to CVE-2026-110816"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110816"
        date = "2026-02-14"
        severity = "medium"

    strings:
        $comma = "arrayFormat" ascii wide
        $comma2 = "'comma'" ascii wide
        $comma3 = "\"comma\"" ascii wide
        $qs = "qs.stringify" ascii wide
        $join = ".join(',')" ascii wide
        $tostr = "toString" ascii wide
        $err = "Cannot convert object to primitive value" ascii wide

    condition:
        (uint32(0) == 0x6d736f63 or uint32(0) == 0x7b0a2020 or filesize < 5MB) and
        (
            ($qs and $comma) or
            ($comma2 and $join and $tostr) or
            ($comma3 and $join and $tostr) or
            $err
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110816 qs stringify comma arrayFormat coercion attempt"; flow:established,to_server; http.method; content:"POST"; http.header; content:"application/json"; content:"toString"; http.request_body; content:"\"toString\""; nocase; reference:cve,2026-110816; classtype:attempted-dos; sid:2026110816; rev:1;)

Elastic Detection

process where process.name == "node" and
  message : ("Cannot convert object to primitive value" or "stringify" or "arrayFormat") and
  message : "comma"

Splunk SPL Query

index=application_logs (message="*Cannot convert object to primitive value*" OR message="*qs.stringify*")
| where match(message, "(?i)comma") OR match(message, "(?i)arrayFormat")
| stats count min(_time) as first_seen max(_time) as last_seen by host, source, message
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="qs,nodejs,web,">
  <rule id="110816" level="7">
    <decoded_as>json</decoded_as>
    <match>Cannot convert object to primitive value</match>
    <description>CVE-2026-110816: qs stringify comma arrayFormat type coercion denial of service</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>cve_2026_110816,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, affected-version list, or workaround is currently published.

1. Immediate mitigations.

   • Avoid using arrayFormat: 'comma' when stringifying arrays whose elements may be attacker-controlled or non-primitive. Where feasible, switch to the indices, brackets, or repeat formats, which the description confirms walk into object elements instead of coercing them and are not affected.
   • Sanitize and normalize data before stringification: coerce array elements to strings with explicit, guarded logic that handles non-callable toString and null-prototype objects, rather than relying on implicit join/String() coercion.
   • On the ingestion side, avoid non-default parse options (allowPrototypes: true, plainObjects: true) for untrusted query strings unless strictly required, since these options preserve the toString key or produce null-prototype elements that trigger the flaw. Default parse options drop toString and produce ordinary objects.
   • Add global uncaught-exception handling and request-level error middleware so a thrown TypeError fails the request cleanly instead of terminating the process, reducing the availability impact.

2. Patch / upgrade steps.

   • No patch currently exists. Monitor the qs project's release channels and the NVD entry for CVE-2026-110816 for an upstream fix. Once a patched version is released, upgrade qs (including transitive copies) to the fixed version and re-verify behavior with arrayFormat: 'comma' and encodeValuesOnly: true.

3. Long-term hardening.

   • Inventory all Node.js applications and dependencies that consume qs, including transitive dependencies, and flag those using arrayFormat: 'comma'.
   • Enforce schema validation on inbound JSON and query input so array elements are constrained to expected primitive types.
   • Adopt dependency monitoring and SBOM tooling to detect when an affected version and a fix become available.
   • Apply the principle of least exposure for parse options that alter object prototypes during querystring parsing.

References

• NVD — CVE-2026-110816: https://nvd.nist.gov/vuln/detail/CVE-2026-110816
• CWE-248 (Uncaught Exception): https://cwe.mitre.org/data/definitions/248.html
• MITRE ATT&CK T1499 (Endpoint Denial of Service): https://attack.mitre.org/techniques/T1499/
• qs library project (source and release channel): https://github.com/ljharb/qs
• CISA Known Exploited Vulnerabilities Catalog (no entry for CVE-2026-110816 as of this writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat-actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-110816 in the supplied intelligence data.