Vulnerability-Lookup

OPENSUSE-SU-2026:12429-1

Vulnerability from csaf_opensuse - Published: 2026-11-05 00:00 - Updated: 2026-11-06 11:27

Summary

git-bug-0.11.0-4.1 on GA media

Severity

Moderate

Notes

Title of the patch: git-bug-0.11.0-4.1 on GA media

Description of the patch: These are all security issues fixed in the git-bug-0.11.0-4.1 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2026-12429

CVE-2026-110910

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected products

Recommended 16 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-111181

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 16 products, the same list as for CVE-2026-110910

Threats

Impact important

CVE-2026-114604

Affected products

Recommended 16 products, the same list as for CVE-2026-110910

Threats

Impact moderate

References

11 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://www.suse.com/security/cve/CVE-2026-110910/	self
https://www.suse.com/security/cve/CVE-2026-111181/	self
https://www.suse.com/security/cve/CVE-2026-114604/	self
https://www.suse.com/security/cve/CVE-2026-110910	external
https://bugzilla.suse.com/1288149	external
https://www.suse.com/security/cve/CVE-2026-111181	external
https://bugzilla.suse.com/1287331	external
https://www.suse.com/security/cve/CVE-2026-114604	external
https://bugzilla.suse.com/1287361	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "git-bug-0.11.0-4.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the git-bug-0.11.0-4.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-12429",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12429-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-110910 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-110910/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-111181 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-111181/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-114604 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-114604/"
      }
    ],
    "title": "git-bug-0.11.0-4.1 on GA media",
    "tracking": {
      "current_release_date": "2026-11-06T11:27:15Z",
      "generator": {
        "date": "2026-11-05T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:12429-1",
      "initial_release_date": "2026-11-05T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-11-05T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-11-06T11:27:15Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "git-bug-0:0.11.0-4.1.aarch64",
                "product": {
                  "name": "git-bug-0:0.11.0-4.1.aarch64",
                  "product_id": "git-bug-0:0.11.0-4.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/git-bug@0.11.0-4.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "git-bug-bash-completion-0:0.11.0-4.1.aarch64",
                "product": {
                  "name": "git-bug-bash-completion-0:0.11.0-4.1.aarch64",
                  "product_id": "git-bug-bash-completion-0:0.11.0-4.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/git-bug-bash-completion@0.11.0-4.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "git-bug-fish-completion-0:0.11.0-4.1.aarch64",
                "product": {
                  "name": "git-bug-fish-completion-0:0.11.0-4.1.aarch64",
                  "product_id": "git-bug-fish-completion-0:0.11.0-4.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/git-bug-fish-completion@0.11.0-4.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "git-bug-zsh-completion-0:0.11.0-4.1.aarch64",
                "product": {
                  "name": "git-bug-zsh-completion-0:0.11.0-4.1.aarch64",
                  "product_id": "git-bug-zsh-completion-0:0.11.0-4.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/git-bug-zsh-completion@0.11.0-4.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "git-bug-0:0.11.0-4.1.ppc64le",
                "product": {
                  "name": "git-bug-0:0.11.0-4.1.ppc64le",
                  "product_id": "git-bug-0:0.11.0-4.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/git-bug@0.11.0-4.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "git-bug-bash-completion-0:0.11.0-4.1.ppc64le",
                "product": {
                  "name": "git-bug-bash-completion-0:0.11.0-4.1.ppc64le",
                  "product_id": "git-bug-bash-completion-0:0.11.0-4.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/git-bug-bash-completion@0.11.0-4.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "git-bug-fish-completion-0:0.11.0-4.1.ppc64le",
                "product": {
                  "name": "git-bug-fish-completion-0:0.11.0-4.1.ppc64le",
                  "product_id": "git-bug-fish-completion-0:0.11.0-4.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/git-bug-fish-completion@0.11.0-4.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "git-bug-zsh-completion-0:0.11.0-4.1.ppc64le",
                "product": {
                  "name": "git-bug-zsh-completion-0:0.11.0-4.1.ppc64le",
                  "product_id": "git-bug-zsh-completion-0:0.11.0-4.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/git-bug-zsh-completion@0.11.0-4.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "git-bug-0:0.11.0-4.1.s390x",
                "product": {
                  "name": "git-bug-0:0.11.0-4.1.s390x",
                  "product_id": "git-bug-0:0.11.0-4.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/git-bug@0.11.0-4.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "git-bug-bash-completion-0:0.11.0-4.1.s390x",
                "product": {
                  "name": "git-bug-bash-completion-0:0.11.0-4.1.s390x",
                  "product_id": "git-bug-bash-completion-0:0.11.0-4.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/git-bug-bash-completion@0.11.0-4.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "git-bug-fish-completion-0:0.11.0-4.1.s390x",
                "product": {
                  "name": "git-bug-fish-completion-0:0.11.0-4.1.s390x",
                  "product_id": "git-bug-fish-completion-0:0.11.0-4.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/git-bug-fish-completion@0.11.0-4.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "git-bug-zsh-completion-0:0.11.0-4.1.s390x",
                "product": {
                  "name": "git-bug-zsh-completion-0:0.11.0-4.1.s390x",
                  "product_id": "git-bug-zsh-completion-0:0.11.0-4.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/git-bug-zsh-completion@0.11.0-4.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "git-bug-0:0.11.0-4.1.x86_64",
                "product": {
                  "name": "git-bug-0:0.11.0-4.1.x86_64",
                  "product_id": "git-bug-0:0.11.0-4.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/git-bug@0.11.0-4.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "git-bug-bash-completion-0:0.11.0-4.1.x86_64",
                "product": {
                  "name": "git-bug-bash-completion-0:0.11.0-4.1.x86_64",
                  "product_id": "git-bug-bash-completion-0:0.11.0-4.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/git-bug-bash-completion@0.11.0-4.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "git-bug-fish-completion-0:0.11.0-4.1.x86_64",
                "product": {
                  "name": "git-bug-fish-completion-0:0.11.0-4.1.x86_64",
                  "product_id": "git-bug-fish-completion-0:0.11.0-4.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/git-bug-fish-completion@0.11.0-4.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "git-bug-zsh-completion-0:0.11.0-4.1.x86_64",
                "product": {
                  "name": "git-bug-zsh-completion-0:0.11.0-4.1.x86_64",
                  "product_id": "git-bug-zsh-completion-0:0.11.0-4.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/git-bug-zsh-completion@0.11.0-4.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-bug-0:0.11.0-4.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.aarch64"
        },
        "product_reference": "git-bug-0:0.11.0-4.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-bug-0:0.11.0-4.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.ppc64le"
        },
        "product_reference": "git-bug-0:0.11.0-4.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-bug-0:0.11.0-4.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.s390x"
        },
        "product_reference": "git-bug-0:0.11.0-4.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-bug-0:0.11.0-4.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.x86_64"
        },
        "product_reference": "git-bug-0:0.11.0-4.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-bug-bash-completion-0:0.11.0-4.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.aarch64"
        },
        "product_reference": "git-bug-bash-completion-0:0.11.0-4.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-bug-bash-completion-0:0.11.0-4.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.ppc64le"
        },
        "product_reference": "git-bug-bash-completion-0:0.11.0-4.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-bug-bash-completion-0:0.11.0-4.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.s390x"
        },
        "product_reference": "git-bug-bash-completion-0:0.11.0-4.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-bug-bash-completion-0:0.11.0-4.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.x86_64"
        },
        "product_reference": "git-bug-bash-completion-0:0.11.0-4.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-bug-fish-completion-0:0.11.0-4.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.aarch64"
        },
        "product_reference": "git-bug-fish-completion-0:0.11.0-4.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-bug-fish-completion-0:0.11.0-4.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.ppc64le"
        },
        "product_reference": "git-bug-fish-completion-0:0.11.0-4.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-bug-fish-completion-0:0.11.0-4.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.s390x"
        },
        "product_reference": "git-bug-fish-completion-0:0.11.0-4.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-bug-fish-completion-0:0.11.0-4.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.x86_64"
        },
        "product_reference": "git-bug-fish-completion-0:0.11.0-4.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-bug-zsh-completion-0:0.11.0-4.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.aarch64"
        },
        "product_reference": "git-bug-zsh-completion-0:0.11.0-4.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-bug-zsh-completion-0:0.11.0-4.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.ppc64le"
        },
        "product_reference": "git-bug-zsh-completion-0:0.11.0-4.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-bug-zsh-completion-0:0.11.0-4.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.s390x"
        },
        "product_reference": "git-bug-zsh-completion-0:0.11.0-4.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-bug-zsh-completion-0:0.11.0-4.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.x86_64"
        },
        "product_reference": "git-bug-zsh-completion-0:0.11.0-4.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-110910",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-110910"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "### Summary\n\n\n\n`qs.stringify` with `allowEmptyArrays: true` writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains `\u0026` (or the configured `delimiter`), `=`, or `#` therefore becomes query string syntax instead of data, so a caller-supplied key name can add parameters to the serialized query string, or cut it short.\n\n\n\n### Details\n\n\n\nIn `lib/stringify.js`, the `allowEmptyArrays` branch returns `adjustedPrefix + \u0027[]\u0027` early, before the code that passes every other key through `encoder` and `formatter`. So `{ \"x\u0026k=v\": [\"1\"] }` serializes as `x%26k%3Dv%5B0%5D=1`, but `{ \"x\u0026k=v\": [] }` serializes as `x\u0026k=v[]`. The early return applies at any depth (`{ \"a\": { \"b\u0026k=v\": [] } }` gives `a[b\u0026k=v][]`), under every `arrayFormat`, with `allowDots`, and with a custom `encoder`, which is never called for that key. With `encode: false` or `encodeValuesOnly: true`, keys are intentionally left unencoded on every path; those configurations are not affected.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nvar query = qs.stringify({ q: \"hi\", \"x\u0026apiKey=evil\u0026y\": [] }, { allowEmptyArrays: true });\n\n\n\n// \"q=hi\u0026x\u0026apiKey=evil\u0026y[]\"\n\n\n\nqs.parse(query);\n\n\n\n// { q: \"hi\", x: \"\", apiKey: \"evil\", y: [\"\"] }\n\n\n\nqs.stringify({ \"x#\": [], z: \"1\" }, { allowEmptyArrays: true });\n\n\n\n// \"x#[]\u0026z=1\": in a URL, everything after \"#\" becomes the fragment\n\n\n\n```\n\n\n\n#### Fix\n\n\n\nApplied in 234d505 on `main` and released as v6.17.0, and backported to v6.16.2, v6.15.4, v6.14.3, v6.13.4, and v6.12.6: the key of an empty array goes through `encoder` and `formatter` exactly as the key of any other value does, so `{ \"x\u0026apiKey=evil\u0026y\": [] }` now serializes as `x%26apiKey%3Devil%26y[]`. Keys that need no encoding serialize as before, with two exceptions that match every other path: the brackets of a nested key are now encoded (`a[b][]` becomes `a%5Bb%5D[]`, which `qs.parse` reads identically), and with `encodeDotInKeys`, a dot in the key becomes `%252E` instead of `%2E` (which `decodeDotInKeys` previously misread as nesting).\n\n\n\n### Affected versions\n\n\n\n- `\u003e=6.12.0 \u003c6.12.6`, fixed in v6.12.6\n\n\n\n- `\u003e=6.13.0 \u003c6.13.4`, fixed in v6.13.4\n\n\n\n- `\u003e=6.14.0 \u003c6.14.3`, fixed in v6.14.3\n\n\n\n- `\u003e=6.15.0 \u003c6.15.4`, fixed in v6.15.4\n\n\n\n- `\u003e=6.16.0 \u003c6.16.2`, fixed in v6.16.2\n\n\n\nv6.17.0 and later are not affected.\n\n\n\n`allowEmptyArrays` was introduced in f22b2bc and first shipped in v6.12.0, with this early return. Earlier versions have no `allowEmptyArrays` option and are not affected.\n\n\n\n### Impact\n\n\n\nAn application that passes an object whose key names come from untrusted input to `qs.stringify` with `allowEmptyArrays: true` (for example, to forward a parsed JSON body or user-selected fields to an upstream service) can have parameters injected into the resulting query string. The injected parameters are not keys of the object, so deleting or overwriting a key on the object (such as setting a trusted `apiKey` after copying the user\u0027s fields) does not remove them; whether the attacker\u0027s value or the application\u0027s wins depends on how the receiving side handles a duplicate parameter. A `#` in such a key ends the query string early when the result is placed in a URL. `allowEmptyArrays` is off by default, and only keys whose value (after any `filter`) is an empty array are affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.aarch64",
          "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.ppc64le",
          "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.s390x",
          "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.x86_64",
          "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.aarch64",
          "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.ppc64le",
          "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.s390x",
          "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.x86_64",
          "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.aarch64",
          "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.ppc64le",
          "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.s390x",
          "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.x86_64",
          "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.aarch64",
          "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.ppc64le",
          "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.s390x",
          "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-110910",
          "url": "https://www.suse.com/security/cve/CVE-2026-110910"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1288149 for CVE-2026-110910",
          "url": "https://bugzilla.suse.com/1288149"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.aarch64",
            "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.ppc64le",
            "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.s390x",
            "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.x86_64",
            "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.aarch64",
            "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.ppc64le",
            "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.s390x",
            "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.x86_64",
            "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.aarch64",
            "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.ppc64le",
            "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.s390x",
            "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.x86_64",
            "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.aarch64",
            "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.ppc64le",
            "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.s390x",
            "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.aarch64",
            "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.ppc64le",
            "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.s390x",
            "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.x86_64",
            "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.aarch64",
            "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.ppc64le",
            "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.s390x",
            "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.x86_64",
            "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.aarch64",
            "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.ppc64le",
            "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.s390x",
            "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.x86_64",
            "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.aarch64",
            "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.ppc64le",
            "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.s390x",
            "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-05T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-110910"
    },
    {
      "cve": "CVE-2026-111181",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-111181"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.aarch64",
          "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.ppc64le",
          "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.s390x",
          "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.x86_64",
          "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.aarch64",
          "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.ppc64le",
          "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.s390x",
          "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.x86_64",
          "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.aarch64",
          "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.ppc64le",
          "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.s390x",
          "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.x86_64",
          "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.aarch64",
          "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.ppc64le",
          "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.s390x",
          "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-111181",
          "url": "https://www.suse.com/security/cve/CVE-2026-111181"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1287331 for CVE-2026-111181",
          "url": "https://bugzilla.suse.com/1287331"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.aarch64",
            "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.ppc64le",
            "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.s390x",
            "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.x86_64",
            "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.aarch64",
            "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.ppc64le",
            "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.s390x",
            "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.x86_64",
            "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.aarch64",
            "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.ppc64le",
            "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.s390x",
            "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.x86_64",
            "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.aarch64",
            "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.ppc64le",
            "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.s390x",
            "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.aarch64",
            "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.ppc64le",
            "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.s390x",
            "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.x86_64",
            "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.aarch64",
            "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.ppc64le",
            "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.s390x",
            "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.x86_64",
            "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.aarch64",
            "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.ppc64le",
            "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.s390x",
            "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.x86_64",
            "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.aarch64",
            "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.ppc64le",
            "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.s390x",
            "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-05T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-111181"
    },
    {
      "cve": "CVE-2026-114604",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-114604"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. From 10.10.1 until 12.0.2, the @graphql-tools/utils mergeIncrementalResult helper passes incrementalResult.path segments to setObjectKeyPath without runtime primitive-type validation. A non-primitive segment can bypass strict comparisons against __proto__, constructor, and prototype, then be coerced during property access so a malicious or compromised upstream incremental GraphQL response writes attacker-controlled properties to Object.prototype in the consuming Node.js process. The affected implementation is packages/utils/src/mergeIncrementalResult.ts and is reachable when consumers merge untrusted @defer or @stream transport results. This issue is fixed in version 12.0.2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.aarch64",
          "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.ppc64le",
          "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.s390x",
          "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.x86_64",
          "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.aarch64",
          "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.ppc64le",
          "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.s390x",
          "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.x86_64",
          "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.aarch64",
          "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.ppc64le",
          "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.s390x",
          "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.x86_64",
          "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.aarch64",
          "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.ppc64le",
          "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.s390x",
          "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-114604",
          "url": "https://www.suse.com/security/cve/CVE-2026-114604"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1287361 for CVE-2026-114604",
          "url": "https://bugzilla.suse.com/1287361"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.aarch64",
            "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.ppc64le",
            "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.s390x",
            "openSUSE Tumbleweed:git-bug-0:0.11.0-4.1.x86_64",
            "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.aarch64",
            "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.ppc64le",
            "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.s390x",
            "openSUSE Tumbleweed:git-bug-bash-completion-0:0.11.0-4.1.x86_64",
            "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.aarch64",
            "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.ppc64le",
            "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.s390x",
            "openSUSE Tumbleweed:git-bug-fish-completion-0:0.11.0-4.1.x86_64",
            "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.aarch64",
            "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.ppc64le",
            "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.s390x",
            "openSUSE Tumbleweed:git-bug-zsh-completion-0:0.11.0-4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-05T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-114604"
    }
  ]
}

CVE-2026-110910 (GCVE-0-2026-110910)

Vulnerability from cvelistv5 – Published: 2026-10-27 06:42 – Updated: 2026-11-04 15:01

Title

qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection

Summary

### Summary `qs.stringify` with `allowEmptyArrays: true` writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains `&` (or the configured `delimiter`), `=`, or `#` therefore becomes query string syntax instead of data, so a caller-supplied key name can add parameters to the serialized query string, or cut it short. ### Details In `lib/stringify.js`, the `allowEmptyArrays` branch returns `adjustedPrefix + '[]'` early, before the code that passes every other key through `encoder` and `formatter`. So `{ "x&k=v": ["1"] }` serializes as `x%26k%3Dv%5B0%5D=1`, but `{ "x&k=v": [] }` serializes as `x&k=v[]`. The early return applies at any depth (`{ "a": { "b&k=v": [] } }` gives `a[b&k=v][]`), under every `arrayFormat`, with `allowDots`, and with a custom `encoder`, which is never called for that key. With `encode: false` or `encodeValuesOnly: true`, keys are intentionally left unencoded on every path; those configurations are not affected. #### PoC ```js var qs = require("qs"); var query = qs.stringify({ q: "hi", "x&apiKey=evil&y": [] }, { allowEmptyArrays: true }); // "q=hi&x&apiKey=evil&y[]" qs.parse(query); // { q: "hi", x: "", apiKey: "evil", y: [""] } qs.stringify({ "x#": [], z: "1" }, { allowEmptyArrays: true }); // "x#[]&z=1": in a URL, everything after "#" becomes the fragment ``` #### Fix Applied in 234d505 on `main` and released as v6.17.0, and backported to v6.16.2, v6.15.4, v6.14.3, v6.13.4, and v6.12.6: the key of an empty array goes through `encoder` and `formatter` exactly as the key of any other value does, so `{ "x&apiKey=evil&y": [] }` now serializes as `x%26apiKey%3Devil%26y[]`. Keys that need no encoding serialize as before, with two exceptions that match every other path: the brackets of a nested key are now encoded (`a[b][]` becomes `a%5Bb%5D[]`, which `qs.parse` reads identically), and with `encodeDotInKeys`, a dot in the key becomes `%252E` instead of `%2E` (which `decodeDotInKeys` previously misread as nesting). ### Affected versions - `>=6.12.0 <6.12.6`, fixed in v6.12.6 - `>=6.13.0 <6.13.4`, fixed in v6.13.4 - `>=6.14.0 <6.14.3`, fixed in v6.14.3 - `>=6.15.0 <6.15.4`, fixed in v6.15.4 - `>=6.16.0 <6.16.2`, fixed in v6.16.2 v6.17.0 and later are not affected. `allowEmptyArrays` was introduced in f22b2bc and first shipped in v6.12.0, with this early return. Earlier versions have no `allowEmptyArrays` option and are not affected. ### Impact An application that passes an object whose key names come from untrusted input to `qs.stringify` with `allowEmptyArrays: true` (for example, to forward a parsed JSON body or user-selected fields to an upstream service) can have parameters injected into the resulting query string. The injected parameters are not keys of the object, so deleting or overwriting a key on the object (such as setting a trusted `apiKey` after copying the user's fields) does not remove them; whether the attacker's value or the application's wins depends on how the receiving side handles a duplicate parameter. A `#` in such a key ends the query string early when the result is placed in a URL. `allowEmptyArrays` is off by default, and only keys whose value (after any `filter`) is an empty array are affected.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 14:51 UTC

CWE

CWE-116 - Improper Encoding or Escaping of Output

Assigner

harborist CNA under the redhat root

CNA scorecard B 86/100 over 22 records in the last 180 days details

References

9 references

URL	Tags
https://github.com/ljharb/qs/security/advisories/…	vendor-advisory
https://github.com/ljharb/qs/commit/234d5051f5071…	patch
https://github.com/ljharb/qs/commit/6b8bf1a53d7b0…	patch
https://github.com/ljharb/qs/commit/033526fc82f2e…	patch
https://github.com/ljharb/qs/commit/f9dd4830cb922…	patch
https://github.com/ljharb/qs/commit/ad445aa23e4c3…	patch
https://github.com/ljharb/qs/commit/5d3b1b9ec6afd…	patch
https://github.com/ljharb/qs/pull/561	patch
https://github.com/ljharb/qs/issues/626	issue-tracking

Impacted products

1 product

Vendor	Product	Version
ljharb	qs	Affected: 6.12.0 , < 6.12.6 (semver) Affected: 6.13.0 , < 6.13.4 (semver) Affected: 6.14.0 , < 6.14.3 (semver) Affected: 6.15.0 , < 6.15.4 (semver) Affected: 6.16.0 , < 6.16.2 (semver)

Credits

DucMinhNe DucMinhNe ljharb

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110910",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T14:51:00.550616Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T15:01:07.679Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://npmjs.com/qs",
          "defaultStatus": "unaffected",
          "packageName": "qs",
          "product": "qs",
          "repo": "https://github.com/ljharb/qs",
          "vendor": "ljharb",
          "versions": [
            {
              "lessThan": "6.12.6",
              "status": "affected",
              "version": "6.12.0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.13.4",
              "status": "affected",
              "version": "6.13.0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.14.3",
              "status": "affected",
              "version": "6.14.0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.15.4",
              "status": "affected",
              "version": "6.15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.16.2",
              "status": "affected",
              "version": "6.16.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "DucMinhNe"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "DucMinhNe"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "ljharb"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e### Summary\u003c/p\u003e\u003cp\u003e`qs.stringify` with `allowEmptyArrays: true` writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains `\u0026amp;` (or the configured `delimiter`), `=`, or `#` therefore becomes query string syntax instead of data, so a caller-supplied key name can add parameters to the serialized query string, or cut it short.\u003c/p\u003e\u003cp\u003e### Details\u003c/p\u003e\u003cp\u003eIn `lib/stringify.js`, the `allowEmptyArrays` branch returns `adjustedPrefix + \u0027[]\u0027` early, before the code that passes every other key through `encoder` and `formatter`. So `{ \"x\u0026amp;k=v\": [\"1\"] }` serializes as `x%26k%3Dv%5B0%5D=1`, but `{ \"x\u0026amp;k=v\": [] }` serializes as `x\u0026amp;k=v[]`. The early return applies at any depth (`{ \"a\": { \"b\u0026amp;k=v\": [] } }` gives `a[b\u0026amp;k=v][]`), under every `arrayFormat`, with `allowDots`, and with a custom `encoder`, which is never called for that key. With `encode: false` or `encodeValuesOnly: true`, keys are intentionally left unencoded on every path; those configurations are not affected.\u003c/p\u003e\u003cp\u003e#### PoC\u003c/p\u003e\u003cp\u003e```js\u003c/p\u003e\u003cp\u003evar qs = require(\"qs\");\u003c/p\u003e\u003cp\u003evar query = qs.stringify({ q: \"hi\", \"x\u0026amp;apiKey=evil\u0026amp;y\": [] }, { allowEmptyArrays: true });\u003c/p\u003e\u003cp\u003e// \"q=hi\u0026amp;x\u0026amp;apiKey=evil\u0026amp;y[]\"\u003c/p\u003e\u003cp\u003eqs.parse(query);\u003c/p\u003e\u003cp\u003e// { q: \"hi\", x: \"\", apiKey: \"evil\", y: [\"\"] }\u003c/p\u003e\u003cp\u003eqs.stringify({ \"x#\": [], z: \"1\" }, { allowEmptyArrays: true });\u003c/p\u003e\u003cp\u003e// \"x#[]\u0026amp;z=1\": in a URL, everything after \"#\" becomes the fragment\u003c/p\u003e\u003cp\u003e```\u003c/p\u003e\u003cp\u003e#### Fix\u003c/p\u003e\u003cp\u003eApplied in 234d505 on `main` and released as v6.17.0, and backported to v6.16.2, v6.15.4, v6.14.3, v6.13.4, and v6.12.6: the key of an empty array goes through `encoder` and `formatter` exactly as the key of any other value does, so `{ \"x\u0026amp;apiKey=evil\u0026amp;y\": [] }` now serializes as `x%26apiKey%3Devil%26y[]`. Keys that need no encoding serialize as before, with two exceptions that match every other path: the brackets of a nested key are now encoded (`a[b][]` becomes `a%5Bb%5D[]`, which `qs.parse` reads identically), and with `encodeDotInKeys`, a dot in the key becomes `%252E` instead of `%2E` (which `decodeDotInKeys` previously misread as nesting).\u003c/p\u003e\u003cp\u003e### Affected versions\u003c/p\u003e\u003cp\u003e- `\u0026gt;=6.12.0 \u0026lt;6.12.6`, fixed in v6.12.6\u003c/p\u003e\u003cp\u003e- `\u0026gt;=6.13.0 \u0026lt;6.13.4`, fixed in v6.13.4\u003c/p\u003e\u003cp\u003e- `\u0026gt;=6.14.0 \u0026lt;6.14.3`, fixed in v6.14.3\u003c/p\u003e\u003cp\u003e- `\u0026gt;=6.15.0 \u0026lt;6.15.4`, fixed in v6.15.4\u003c/p\u003e\u003cp\u003e- `\u0026gt;=6.16.0 \u0026lt;6.16.2`, fixed in v6.16.2\u003c/p\u003e\u003cp\u003ev6.17.0 and later are not affected.\u003c/p\u003e\u003cp\u003e`allowEmptyArrays` was introduced in f22b2bc and first shipped in v6.12.0, with this early return. Earlier versions have no `allowEmptyArrays` option and are not affected.\u003c/p\u003e\u003cp\u003e### Impact\u003c/p\u003e\u003cp\u003eAn application that passes an object whose key names come from untrusted input to `qs.stringify` with `allowEmptyArrays: true` (for example, to forward a parsed JSON body or user-selected fields to an upstream service) can have parameters injected into the resulting query string. The injected parameters are not keys of the object, so deleting or overwriting a key on the object (such as setting a trusted `apiKey` after copying the user\u0027s fields) does not remove them; whether the attacker\u0027s value or the application\u0027s wins depends on how the receiving side handles a duplicate parameter. A `#` in such a key ends the query string early when the result is placed in a URL. `allowEmptyArrays` is off by default, and only keys whose value (after any `filter`) is an empty array are affected.\u003c/p\u003e"
            }
          ],
          "value": "### Summary\n\n\n\n`qs.stringify` with `allowEmptyArrays: true` writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains `\u0026` (or the configured `delimiter`), `=`, or `#` therefore becomes query string syntax instead of data, so a caller-supplied key name can add parameters to the serialized query string, or cut it short.\n\n\n\n### Details\n\n\n\nIn `lib/stringify.js`, the `allowEmptyArrays` branch returns `adjustedPrefix + \u0027[]\u0027` early, before the code that passes every other key through `encoder` and `formatter`. So `{ \"x\u0026k=v\": [\"1\"] }` serializes as `x%26k%3Dv%5B0%5D=1`, but `{ \"x\u0026k=v\": [] }` serializes as `x\u0026k=v[]`. The early return applies at any depth (`{ \"a\": { \"b\u0026k=v\": [] } }` gives `a[b\u0026k=v][]`), under every `arrayFormat`, with `allowDots`, and with a custom `encoder`, which is never called for that key. With `encode: false` or `encodeValuesOnly: true`, keys are intentionally left unencoded on every path; those configurations are not affected.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nvar query = qs.stringify({ q: \"hi\", \"x\u0026apiKey=evil\u0026y\": [] }, { allowEmptyArrays: true });\n\n\n\n// \"q=hi\u0026x\u0026apiKey=evil\u0026y[]\"\n\n\n\nqs.parse(query);\n\n\n\n// { q: \"hi\", x: \"\", apiKey: \"evil\", y: [\"\"] }\n\n\n\nqs.stringify({ \"x#\": [], z: \"1\" }, { allowEmptyArrays: true });\n\n\n\n// \"x#[]\u0026z=1\": in a URL, everything after \"#\" becomes the fragment\n\n\n\n```\n\n\n\n#### Fix\n\n\n\nApplied in 234d505 on `main` and released as v6.17.0, and backported to v6.16.2, v6.15.4, v6.14.3, v6.13.4, and v6.12.6: the key of an empty array goes through `encoder` and `formatter` exactly as the key of any other value does, so `{ \"x\u0026apiKey=evil\u0026y\": [] }` now serializes as `x%26apiKey%3Devil%26y[]`. Keys that need no encoding serialize as before, with two exceptions that match every other path: the brackets of a nested key are now encoded (`a[b][]` becomes `a%5Bb%5D[]`, which `qs.parse` reads identically), and with `encodeDotInKeys`, a dot in the key becomes `%252E` instead of `%2E` (which `decodeDotInKeys` previously misread as nesting).\n\n\n\n### Affected versions\n\n\n\n- `\u003e=6.12.0 \u003c6.12.6`, fixed in v6.12.6\n\n\n\n- `\u003e=6.13.0 \u003c6.13.4`, fixed in v6.13.4\n\n\n\n- `\u003e=6.14.0 \u003c6.14.3`, fixed in v6.14.3\n\n\n\n- `\u003e=6.15.0 \u003c6.15.4`, fixed in v6.15.4\n\n\n\n- `\u003e=6.16.0 \u003c6.16.2`, fixed in v6.16.2\n\n\n\nv6.17.0 and later are not affected.\n\n\n\n`allowEmptyArrays` was introduced in f22b2bc and first shipped in v6.12.0, with this early return. Earlier versions have no `allowEmptyArrays` option and are not affected.\n\n\n\n### Impact\n\n\n\nAn application that passes an object whose key names come from untrusted input to `qs.stringify` with `allowEmptyArrays: true` (for example, to forward a parsed JSON body or user-selected fields to an upstream service) can have parameters injected into the resulting query string. The injected parameters are not keys of the object, so deleting or overwriting a key on the object (such as setting a trusted `apiKey` after copying the user\u0027s fields) does not remove them; whether the attacker\u0027s value or the application\u0027s wins depends on how the receiving side handles a duplicate parameter. A `#` in such a key ends the query string early when the result is placed in a URL. `allowEmptyArrays` is off by default, and only keys whose value (after any `filter`) is an empty array are affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-116",
              "description": "CWE-116 Improper Encoding or Escaping of Output",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T19:32:36.456Z",
        "orgId": "7ffcee3d-2c14-4c3e-b844-86c6a321a158",
        "shortName": "harborist"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/ljharb/qs/security/advisories/GHSA-w4cr-vjpx-p82q"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ljharb/qs/commit/234d5051f5071efaa025a7ca9e4d34a56a460a1b"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ljharb/qs/commit/6b8bf1a53d7b0c5e7e434eaae8e2c0cffd5c2492"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ljharb/qs/commit/033526fc82f2e80a3d896df2bce9137e34cb5dc5"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ljharb/qs/commit/f9dd4830cb922363822cdfdca2cceb3ed9792224"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ljharb/qs/commit/ad445aa23e4c3a97394c3b9a5f9d7a7159eb1f17"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ljharb/qs/commit/5d3b1b9ec6afd0cfc760c8e12862873789a32fc8"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ljharb/qs/pull/561"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/ljharb/qs/issues/626"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrade to qs 6.17.0 or later, or, on an older release line, to 6.12.6, 6.13.4, 6.14.3, 6.15.4, or 6.16.2.\u003c/p\u003e"
            }
          ],
          "value": "Upgrade to qs 6.17.0 or later, or, on an older release line, to 6.12.6, 6.13.4, 6.14.3, 6.15.4, or 6.16.2."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eLeave `allowEmptyArrays` off (the default), or check key names that come from untrusted input against an allowlist before passing the object to `qs.stringify`.\u003c/p\u003e"
            }
          ],
          "value": "Leave `allowEmptyArrays` off (the default), or check key names that come from untrusted input against an allowlist before passing the object to `qs.stringify`."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7ffcee3d-2c14-4c3e-b844-86c6a321a158",
    "assignerShortName": "harborist",
    "cveId": "CVE-2026-110910",
    "datePublished": "2026-10-27T06:42:42.365Z",
    "dateReserved": "2026-10-15T03:01:58.840Z",
    "dateUpdated": "2026-11-04T15:01:07.679Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-111181 (GCVE-0-2026-111181)

Vulnerability from cvelistv5 – Published: 2026-10-22 14:29 – Updated: 2026-10-22 19:00

Title

body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body

Summary

body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-22 18:26 UTC

CWE

CWE-248 - Uncaught Exception

Assigner

openjs CNA under the redhat root

CNA scorecard C 65/100 over 127 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/expressjs/body-parser/security…
https://cna.openjsf.org/security-advisories.html

Impacted products

1 product

Vendor	Product	Version
body-parser	body-parser	Affected: 2.0.0 , < 2.4.0 (semver) Unaffected: 2.4.0 (semver) Affected: 0 , < 1.20.9 (semver) Unaffected: 1.20.9 (semver)

Credits

blue2cat UlisesGascon bjohansebas Phillip9587

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111181",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-22T18:26:41.855566Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-22T19:00:31.729Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/body-parser",
          "product": "body-parser",
          "vendor": "body-parser",
          "versions": [
            {
              "lessThan": "2.4.0",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.20.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.20.9",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "blue2cat"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "UlisesGascon"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "bjohansebas"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Phillip9587"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created."
            }
          ],
          "value": "body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T14:29:56.577Z",
        "orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "shortName": "openjs"
      },
      "references": [
        {
          "url": "https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828"
        },
        {
          "url": "https://cna.openjsf.org/security-advisories.html"
        }
      ],
      "title": "body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body",
      "x_generator": {
        "engine": "cve-kit 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
    "assignerShortName": "openjs",
    "cveId": "CVE-2026-111181",
    "datePublished": "2026-10-22T14:29:56.577Z",
    "dateReserved": "2026-10-15T17:35:18.184Z",
    "dateUpdated": "2026-10-22T19:00:31.729Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114604 (GCVE-0-2026-114604)

Vulnerability from cvelistv5 – Published: 2026-11-05 20:37 – Updated: 2026-11-09 18:37

Title

GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

Summary

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. From 10.10.1 until 12.0.2, the @graphql-tools/utils mergeIncrementalResult helper passes incrementalResult.path segments to setObjectKeyPath without runtime primitive-type validation. A non-primitive segment can bypass strict comparisons against __proto__, constructor, and prototype, then be coerced during property access so a malicious or compromised upstream incremental GraphQL response writes attacker-controlled properties to Object.prototype in the consuming Node.js process. The affected implementation is packages/utils/src/mergeIncrementalResult.ts and is reachable when consumers merge untrusted @defer or @stream transport results. This issue is fixed in version 12.0.2.

Severity

8.4 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 18:37 UTC

CWE

CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7814 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/ardatan/graphql-tools/security…	x_refsource_CONFIRM
https://github.com/ardatan/graphql-tools/pull/8467	x_refsource_MISC
https://github.com/ardatan/graphql-tools/commit/1…	x_refsource_MISC
https://github.com/ardatan/graphql-tools/commit/2…	x_refsource_MISC
https://github.com/ardatan/graphql-tools/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
ardatan	graphql-tools	Affected: >= 10.10.1, < 12.0.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-114604",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T18:37:03.413717Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T18:37:52.147Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-c4qx-w738-7hr3"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "graphql-tools",
          "vendor": "ardatan",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 10.10.1, \u003c 12.0.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. From 10.10.1 until 12.0.2, the @graphql-tools/utils mergeIncrementalResult helper passes incrementalResult.path segments to setObjectKeyPath without runtime primitive-type validation. A non-primitive segment can bypass strict comparisons against __proto__, constructor, and prototype, then be coerced during property access so a malicious or compromised upstream incremental GraphQL response writes attacker-controlled properties to Object.prototype in the consuming Node.js process. The affected implementation is packages/utils/src/mergeIncrementalResult.ts and is reachable when consumers merge untrusted @defer or @stream transport results. This issue is fixed in version 12.0.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-05T20:37:39.814Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-c4qx-w738-7hr3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-c4qx-w738-7hr3"
        },
        {
          "name": "https://github.com/ardatan/graphql-tools/pull/8467",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ardatan/graphql-tools/pull/8467"
        },
        {
          "name": "https://github.com/ardatan/graphql-tools/commit/19f5b3373fd7ace0688d19950fc529ce8347952a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ardatan/graphql-tools/commit/19f5b3373fd7ace0688d19950fc529ce8347952a"
        },
        {
          "name": "https://github.com/ardatan/graphql-tools/commit/20d36a5c6eb8fd5524420988e01a48618c450d70",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ardatan/graphql-tools/commit/20d36a5c6eb8fd5524420988e01a48618c450d70"
        },
        {
          "name": "https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/utils@12.0.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/utils@12.0.2"
        }
      ],
      "source": {
        "advisory": "GHSA-c4qx-w738-7hr3",
        "discovery": "UNKNOWN"
      },
      "title": "GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-114604",
    "datePublished": "2026-11-05T20:37:39.814Z",
    "dateReserved": "2026-10-21T20:34:25.599Z",
    "dateUpdated": "2026-11-09T18:37:52.147Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OPENSUSE-SU-2026:12429-1

CVE-2026-110910 (GCVE-0-2026-110910)

CVE-2026-111181 (GCVE-0-2026-111181)

CVE-2026-114604 (GCVE-0-2026-114604)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour