Skip to content
OpenAdvisories

Package · Debian

node-qs

10 known vulnerabilities.

3 results · Clear filters · Feed

  • Medium 5.3

    qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a string

    ### Summary `qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ "toString": "x" }`) or a null-pr…

  • Medium 5.3

    qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property

    ### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that…

  • Medium 5.3

    qs.stringify crashes on null/undefined entries in comma-format arrays under encodeValuesOnly

    ### Summary `qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strict…