Search/CVE-2026-110910
● CVE — Low

CVE-2026-110910

DiscoveredOct 27, 2026UpdatedOct 27, 2026

Summary qs.stringify with allowEmptyArrays: true writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains & (or the configured delimiter), =, or # therefore becomes query string syntax instead of data, so a caller-supplied key name can add parameters to the serialized query string, or cut it short. Details In lib/stringify.js, the allowEmptyArrays branch returns adjustedPrefix + '[]' early, before the code that passes every other key through encoder and formatter. So { "x&k=v": ["1"] } serializes as x%26k%3Dv%5B0%5D=1, but { "x&k=v": [] } serializes as x&k=v[]. The early return applies at any depth ({ "a": { "b&k=v": [] } } gives a[b&k=v][]), under every arrayFormat, with allowDots, and with a custom encoder, which is never called…

CVSS v3.1
3.7 LOW
EPSS
0.29%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Oct 28, 2026 → Oct 29, 2026
▲ 0.06pp
0.23% → 0.29% over 2 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityHIGH
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityNONE
IntegrityLOW
AvailabilityNONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Connections
1 relationships
Timeline
disclosure → media coverage
Oct 27, 2026
Disclosure — published as a CVE record.