ljharb

qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection

qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a string

qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property

qs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391)

shell-quote parse() is quadratic in token count, enabling denial of service