Ljharb Qs vulnerabilities

CVE-2026-2391 [HIGH] CWE-20 CVE-2026-2391: ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `c ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284). ### Details When the `c

CVE-2026-8723 [MEDIUM] CWE-476 CVE-2026-8723: ### Summary `qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encode ### Summary `qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strictNullHandling`). ### Details In the comma + `encodeValuesOnly` branch, `lib/stringify.js:145

CVE-2026-82417 [MEDIUM] CWE-248 CVE-2026-82417: ### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `construct ### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: "x" } }` makes the ca