CVE-2026-110816: qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)

qs.stringify(obj, { arrayFormat: 'comma' }) throws an uncaught TypeError: Cannot convert object to primitive value when an array in obj contains an element that carries an own, non-callable toString property (for example { a: [ { toString: 'x' } ] }). A remote, unauthenticated attacker who can influence an object that the application later re-serializes with the comma array format triggers the throw. In a service that lacks a synchronous error boundary around the serialization call, the uncaught exception crashes the worker process, producing a denial of service.

In project qs, in versions >= 6.7.0, <= 6.16.0 (every version that supports arrayFormat: 'comma'), qs.stringify with arrayFormat: 'comma' can throw an uncaught TypeError: Cannot convert object to primitive value when an array element has a non-callable own toString. It is fixed in 6.16.1. Related: CWE-248 and CWE-704.