CVE-2026-8723P4MEDIUMCVSS 5.3≥ 6.11.1, < 6.15.22026-05-17
CVE-2026-8723 [MEDIUM] CWE-476 CVE-2026-8723: ### Summary `qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encode
### Summary
`qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strictNullHandling`).
### Details
In the comma + `encodeValuesOnly` branch, `lib/stringify.js:145
nvd