fkie_cve-2026-110910

### Summary

`qs.stringify` with `allowEmptyArrays: true` writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains `&` (or the configured `delimiter`), `=`, or `#` therefore becomes query string syntax instead of data, so a caller-supplied key name can add parameters to the serialized query string, or cut it short.

### Details

In `lib/stringify.js`, the `allowEmptyArrays` branch returns `adjustedPrefix + '[]'` early, before the code that passes every other key through `encoder` and `formatter`. So `{ "x&k=v": ["1"] }` serializes as `x%26k%3Dv%5B0%5D=1`, but `{ "x&k=v": [] }` serializes as `x&k=v[]`. The early return applies at any depth (`{ "a": { "b&k=v": [] } }` gives `a[b&k=v][]`), under every `arrayFormat`, with `allowDots`, and with a custom `encoder`, which is never called for that key. With `encode: false` or `encodeValuesOnly: true`, keys are intentionally left unencoded on every path; those configurations are not affected.

#### PoC

```js

var qs = require("qs");

var query = qs.stringify({ q: "hi", "x&apiKey=evil&y": [] }, { allowEmptyArrays: true });

// "q=hi&x&apiKey=evil&y[]"

qs.parse(query);

// { q: "hi", x: "", apiKey: "evil", y: [""] }

qs.stringify({ "x#": [], z: "1" }, { allowEmptyArrays: true });

// "x#[]&z=1": in a URL, everything after "#" becomes the fragment

```

#### Fix

Applied in 234d505 on `main` and released as v6.17.0, and backported to v6.16.2, v6.15…

Most recent entries from all

fkie_cve-2026-110910