Security patches (release/2.2.0) - autoclosed by renovate[bot] · Pull Request #439 · DefGuard/proxy

renovate · 2026-10-29T09:39:00Z

This PR contains the following updates:

Package	Change	Age	Confidence
qs	`6.16.0` → `6.16.1`
seroval (source)	`1.6.3` → `1.6.11`

qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)

CVE-2026-110816 / GHSA-6pq8-jhm2-2vcw

More information

Details

Summary

qs.stringify(obj, { arrayFormat: 'comma' }) throws an uncaught TypeError: Cannot convert object to primitive value when an array in obj contains an element that carries an own, non-callable toString property (for example { a: [ { toString: 'x' } ] }). A remote, unauthenticated attacker who can influence an object that the application later re-serializes with the comma array format triggers the throw. In a service that lacks a synchronous error boundary around the serialization call, the uncaught exception crashes the worker process, producing a denial of service.

Root Cause

When arrayFormat: 'comma' is selected, the comma branch collapses the whole array into a single value via Array.prototype.join, or, under encodeValuesOnly: true, maps each element through the value encoder before joining. Both paths perform an implicit string coercion (ToPrimitive with hint "string") on each element. For an object whose own toString is a non-callable value, coercion skips the shadowed non-callable toString, falls through to Object.prototype.valueOf (which returns the object rather than a primitive), and throws. The comma branch runs this coercion before the per-element null and skip handling in the main loop, so nothing downstream can neutralize the hostile element, and the throw is never caught inside the library.

lib/stringify.js  (comma-array branch)
  line 152-154: obj = utils.maybeMap(obj, function (v) { return v == null ? v : encoder(v); });  // encodeValuesOnly path
  line 156:     objKeys = [{ value: obj.length > 0 ? obj.join(',') || null : void undefined }];   // default comma path
lib/utils.js
  line 292:     string = String(str);   // value encoder coercion reached via the encodeValuesOnly path

Impact

Prerequisites: the application calls qs.stringify with arrayFormat: 'comma' (a documented, supported option) on an object whose shape can be influenced by attacker input. Attacker-controllable sources include qs.parse(input, { allowPrototypes: true }), which retains a toString segment (Express 4's default query parser, Express 5's extended query parser, and body-parser's extended urlencoded parser all set it), qs.parse(input, { plainObjects: true }), whose null-prototype elements throw even without a toString key (eg, a[][b]=c), and JSON.parse of a request body, which needs no qs parse option at all. No authentication or user interaction is required. Demonstrated capability: a single request forces an uncaught synchronous TypeError in the serialization call. In a naive single-process Node service with no synchronous error boundary, this crashes the process and takes the service offline (availability impact). Under a framework such as Express that traps synchronous handler throws, the plausible outcome is a per-request 500 rather than a full outage; that lower-impact case is noted but not the worst credible supported deployment. There is no confidentiality or integrity impact, no memory unsafety, and no prototype pollution.

Proof of Concept

Install qs at the affected version (for example 6.16.0) and run the following script with Node.js. No network setup is required; it demonstrates the throw in isolation.

var qs = require('qs');

// Source A: qs.parse with allowPrototypes retains the hostile toString segment
qs.stringify(qs.parse('a[0][toString]=x', { allowPrototypes: true }), { arrayFormat: 'comma' });

// Source B: a JSON request body, no qs parse option needed
qs.stringify(JSON.parse('{"a":[{"toString":"x"}]}'), { arrayFormat: 'comma' });

// Also affected: the encodeValuesOnly sub-path
qs.stringify(JSON.parse('{"a":[{"toString":"x"}]}'), { arrayFormat: 'comma', encodeValuesOnly: true });

A default-join (allowPrototypes) => THREW: TypeError: Cannot convert object to primitive value
B default-join (JSON.parse) => THREW: TypeError: Cannot convert object to primitive value
C encodeValuesOnly path => THREW: TypeError: Cannot convert object to primitive value
N2 callable toString => NO THROW; output="a=z"
N3 isBuffer vector (CVE-2026-82417) => NO THROW; output="a%5Bconstructor%5D%5BisBuffer%5D=x"
qs version: 6.16.0

Attack Chain

Exposure: A remote, unauthenticated request reaches an endpoint whose handler eventually serializes attacker-influenced data with qs.stringify(obj, { arrayFormat: 'comma' }).
Control: The attacker supplies data that becomes { a: [ { toString: <non-callable value> } ] }, either via a[0][toString]=x parsed with allowPrototypes, or via a JSON body {"a":[{"toString":"x"}]}.
Path: In stringify, the primitive/buffer guard at lib/stringify.js:134 is false for an array, so control reaches the comma branch at lib/stringify.js:149.
Guard: On the encodeValuesOnly path, the closure v == null ? v : encoder(v) at lib/stringify.js:152-154 passes only null/undefined through; a non-null object still reaches the encoder. The default path skips that closure entirely and reaches obj.join(',') at lib/stringify.js:156 with no guard at all.
Primitive: The element is coerced to a string (Array.prototype.join, or String(str) at lib/utils.js:292). ToPrimitive skips the non-callable own toString, valueOf returns the object, and a TypeError is thrown.
Result: The uncaught synchronous exception propagates out of the serialization call, failing the request and, in a service without a synchronous error boundary, crashing the process (denial of service).

Bypass Evidence

This is a different element type on the code path CVE-2026-8723 (GHSA-q8mj-m7cp-5q26) patched, plus the default comma path, which that fix never covered. CVE-2026-8723 addressed a TypeError crash on null/undefined entries in the comma plus encodeValuesOnly path. Its fix (commit 21f80b3) wraps the encoder in function (v) { return v == null ? v : encoder(v); }, so it only passes null and undefined through. A non-null element with a hostile own toString fails the v == null test, so the encoder still runs and still throws; the encodeValuesOnly case (case C above) throws on the exact fixed code. The default comma path (encodeValuesOnly unset, the library default) never entered that fix at all: git log -S "obj.join(','" -- lib/stringify.js shows no security fix has ever touched the obj.join(',') line, and cases A and B throw with encodeValuesOnly unset. The related isBuffer hardening for CVE-2026-82417 (commit e83d321) is a different sink at the lib/stringify.js:134 guard, which is never entered for the array element; the negative control {a:{constructor:{isBuffer:'x'}}} serializes cleanly. Disproof attempts that failed: a valueOf-only object does not throw (it serializes to [object Object]), confirming the trigger is an element with no callable toString (an own non-callable toString, or a null-prototype object with no toString at all, as qs.parse produces under plainObjects); nested arrays ({"a":[[{"toString":"x"}]]}) throw the same way; a callable toString serializes cleanly; and the default (non-comma) array format serializes cleanly, confirming the comma format is required. All positive and negative cases were reproduced on the exact published 6.16.0 artifact.

Affected Versions

Ecosystem: npm
Package: qs
Confirmed affected range: >= 6.7.0, <= 6.16.0
Latest release checked: 6.16.0 (npm latest; git tag v6.16.0)
Fix status: fixed in 6.16.1 (a952e75)

The arrayFormat: 'comma' join sink was introduced in qs 6.7.0, so 6.7.0 is the lower boundary; releases before 6.7.0 lack the sink. No released version fixes this vector, and the latest published release (6.16.0) reproduces the throw, so the closed upper bound <= 6.16.0 covers every affected release. The encodeValuesOnly sub-path was added later, but the default comma-join vector already affects 6.7.0, so 6.7.0 governs the lower boundary.

Suggested Fix

The comma array serialization must not allow an implicit string coercion of an array element to throw an uncaught exception. Coercion of each comma element should be performed defensively (for example by wrapping the join and per-element encode so that a coercion failure is caught and handled), and this protection must cover both the default obj.join(',') path and the encodeValuesOnly encoder path, not only the previously patched null/undefined case. As an interim mitigation without a code change, applications can avoid arrayFormat: 'comma' when serializing data derived from untrusted input, sanitize parsed objects (avoid allowPrototypes/plainObjects on untrusted input and strip unexpected own properties), or wrap qs.stringify calls in a synchronous error boundary so a coercion failure cannot crash the process.

Reported by zx (GitHub: @manus-pi).

Independent report by @Lucidsec

The following was reported separately, after this advisory, and is merged here as a duplicate.

Summary

In project qs, in versions >= 6.7.0, <= 6.16.0 (every version that supports arrayFormat: 'comma'), qs.stringify with arrayFormat: 'comma' can throw an uncaught TypeError: Cannot convert object to primitive value when an array element has a non-callable own toString. It is fixed in 6.16.1. Related: CWE-248 and CWE-704.

Technical Details

qs.stringify with arrayFormat: 'comma' joins an array at lib/stringify.js:156 via obj.join(','). An element whose own toString is not callable makes Array.prototype.join throw. There is no type check and no catch on that path.

A second path exists with encodeValuesOnly: at lib/stringify.js:151-154, maybeMap only skips v == null, then lib/utils.js:292 does String(str) and throws the same TypeError (this second site exists since v6.11.1; before that, the same input throws at join).

Who can trigger: someone who can shape an array element passed to stringify. The host must use non-default arrayFormat: 'comma'. Default arrayFormat indices does not fold arrays and is not affected. A parse-then-stringify path also needs plainObjects: true (null-prototype elements from lib/parse.js:200) or allowPrototypes: true (which Express 4's default query parser, Express 5's extended query parser, and body-parser's extended urlencoded parser all set). Default qs.parse('a[0][toString]=x') returns {} because the prototype guard drops toString. Direct JSON handed to stringify can supply {"a":[{"toString":"x"}]}.

Cause: the comma fold at lib/stringify.js:149-156 collapses the array into a single value before the main loop at lib/stringify.js:172-212, so skipNulls and strictNullHandling only ever see the joined value, never individual elements. isNonNullishPrimitive / isBuffer at lib/stringify.js:134 inspect the whole value, not each element. A normal object uses Object.prototype.toString and becomes [object Object]. An own non-callable toString is skipped, valueOf returns the object, and join throws. (The skipped TODO test at test/stringify.js:684-689 uses a plain { b: 1 } element, which does not throw; it covers the separate question of what comma format should output for object elements, not this crash.) Earlier comma crash fixes did not cover object elements.

Impact

One small input makes that serialization path throw a synchronous, catchable TypeError. Behind a framework error boundary (eg, a synchronous Express handler), the request fails with a 500 and the process survives. In a host with no error boundary (eg, a bare http.createServer handler), the uncaught exception exits the process (the client sees ECONNRESET). Availability only.

Proof of Concept

Show the proof of concept

Checked on the latest commit that was checked: 07b1d4d82c8f9301c105ea4b94fa2302cfd6e8b4. Still present. Demonstrated.

Payload {"a":[{"toString":"x"}]} throws at lib/stringify.js:156.
Baseline {"a":["x","y"]} returns 200 with body a=x%2Cy.
A plain object element stringifies to a=%5Bobject%20Object%5D and does not throw.
encodeValuesOnly: true throws via utils.js:292.
plainObjects parse plus comma throws.

Suggested Fix

Before join, map elements with the existing primitive check; skip or replace non-primitives so join cannot throw. On the encodeValuesOnly path, do not send non-primitives into String(). Optionally guard lib/utils.js:292. Add new regression tests.

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check

CVE-2026-116580 / GHSA-7rv5-mrxv-xcr9

More information

Details

Summary

When fromJSON rebuilt an async iterator, it called on() on the iterator's source without checking that the source was a seroval stream. A crafted payload could pick another value as the source, such as a function returned by an application plugin. The deserializer then called that value's on method.

This is a variant of GHSA-mv8w-475r-vwqw. That fix covered the promise and stream control nodes but not the async iterator node.

Impact

An application that passes untrusted input to fromJSON with plugins that return callable values can have those callables invoked during deserialization. What this allows depends on what the plugin's values do.

Affected versions

Versions up to 1.6.3 accept any value as the source.
1.6.4 rejects the reported payload.
1.6.5 to 1.6.7 check the source by node type, which a payload can get around by reusing a node id.
All versions up to 1.6.7 should be treated as affected.

Patches

Fixed in seroval@1.6.8. Streams and sequences are now internal class instances. The deserializer checks the source value with instanceof, so plain data and plugin values are rejected no matter which node id they use.

Workarounds

Avoid plugins whose deserialize returns functions or objects with an on method when decoding untrusted input. Upgrading to 1.6.8 is recommended.

Severity

CVSS Score: 7.3 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)

CVE-2026-116581 / GHSA-97r2-qh9m-474h

More information

Details

Summary

fromJSON and fromCrossJSON used two node fields without checking them.

An array node's element list was not checked to be an array. A small payload could set the length the decoder looped over. This part is also tracked in GHSA-wp97-x4hv-qvhp.
A sequence node's done index was not checked. A crafted value produced an iterator that never finished.

Impact

A service that passes untrusted input to fromJSON or fromCrossJSON can be made unavailable by an unauthenticated request.

The array case blocks the thread while the decoder runs.
The sequence case makes any code that reads the resulting iterator to the end run forever.

Patches

Fixed in seroval@1.6.8.

Element lists must be arrays.
A sequence node's throw and done indices must be integers from -1 up to the last element index.

Invalid input throws SerovalMalformedNodeError.

Workarounds

None. Upgrade to 1.6.8.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length

CVE-2026-116584 / GHSA-wp97-x4hv-qvhp

More information

Details

Summary

fromJSON and fromCrossJSON did not check that an array node's element list is an array. A small crafted payload could set the length the decoder used. That length controlled how much memory was allocated and how many times the decoder looped, and it did not depend on the size of the payload.

Impact

A service that passes untrusted input to fromJSON or fromCrossJSON can be made unavailable by an unauthenticated request.

A small payload can allocate enough memory to end the process.
A small payload can block the thread for seconds, or without end.

This affects any framework that decodes request bodies with these functions before its own validation runs.

This issue is a bypass of the fix for GHSA-66fc-rw6m-c2q6 in 1.4.1.

Patches

Fixed in seroval@1.6.8. The deserializer now rejects any node whose element list is not an array, and throws SerovalMalformedNodeError.

Workarounds

None. Upgrade to 1.6.8.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Seroval: Script injection through RegExp sources in serialized output

CVE-2026-116582 / GHSA-9wx9-5pv9-3349

More information

Details

Summary

seroval writes a RegExp as a regular expression literal. In affected versions, the < character in a RegExp source is written without escaping. A source built from untrusted input can then end the HTML <script> element that the serialized output is placed in, and run script in the page.

Details

seroval escapes < in strings, so string values cannot end a <script> element. RegExp sources did not get the same escaping:

Versions before 1.0.0 wrote the source as is.
Version 1.5.5 stopped escaping < in RegExp sources, so that named groups and lookbehinds keep working. This removed the escaping for every < in a source.

These functions are affected:

serialize, serializeAsync
crossSerialize, crossSerializeAsync, crossSerializeStream
the Serializer class
compileJSON

toJSON, fromJSON, toCrossJSON and fromCrossJSON are not affected, because they never produce JavaScript.

Impact

An application is affected when all of these are true:

It builds a RegExp from untrusted input that is used as regular expression syntax. Input passed through an escaping helper (such as an escapeRegExp function) is not enough to exploit this.
It serializes that RegExp with one of the functions above.
It places the output inside an HTML <script> element, as server rendering usually does.

In that case an attacker can run script in the page of any user who receives that output.

Patches

Fixed in 1.6.10. A RegExp whose source contains < is now written with the RegExp constructor and an escaped string source. Named groups and lookbehinds keep working.

Workarounds

If you cannot upgrade:

Do not serialize a RegExp built from untrusted pattern syntax. Send its source and flags as strings, and build the RegExp on the client.
Or reject patterns that contain < before they reach the serializer.

Severity

CVSS Score: 4.7 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Seroval: Code injection through a typed array's own constructor property

CVE-2026-116583 / GHSA-f86p-h4j2-7qgj

More information

Details

Summary

seroval writes a typed array as a call to its constructor. In affected versions, the constructor name in the output is read from a property that data on the value can replace, and it is written without checks. A typed array that received properties from untrusted data can then put arbitrary code into the serialized output.

Details

Version 1.6.0 changed how seroval finds the class of an object, so that objects with their own constructor property serialize correctly. Typed arrays still took the constructor name from the value itself, so the name could come from the untrusted property instead of the array's real type.

These functions are affected:

serialize, serializeAsync
crossSerialize, crossSerializeAsync, crossSerializeStream
the Serializer class
compileJSON

fromJSON and fromCrossJSON are not affected: they only accept the names of the built-in typed arrays. With the compactArrayBufferViews option, the same lookup throws a TypeError instead of writing code.

Impact

An application is affected only when it serializes a typed array that has an own constructor property set from untrusted data. That requires code that copies properties from untrusted objects onto a typed array. This is unusual, so the severity is rated Low, even though the result is script execution in the page that receives the output.

Patches

Fixed in 1.6.11. The constructor name now comes from the array's internal type, which properties on the value cannot change. compactArrayBufferViews uses the real type as well.

Workarounds

If you cannot upgrade, do not copy properties from untrusted objects onto typed arrays, or remove an own constructor property from a typed array before serializing it.

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

ljharb/qs (qs)

`v6.16.1`

Compare Source

[Fix] parse: do not mutate an object input
[Fix] stringify: stop re-encoding structural separator dots when encodeDotInKeys is set (#564)
[Fix] stringify: arrayFormat: 'comma': pass the full encoder arguments with encodeValuesOnly
[Fix] utils: encode + as %2B in iso-8859-1 mode so values round-trip (#565)
[Fix] parse: only convert top-level dots to brackets when allowDots is on (#621)
[Fix] stringify: ignore inherited array format names (#622)
[Fix] stringify: arrayFormat: 'comma': do not throw on elements with no callable toString
[Fix] utils: merge: seed an overflow container's index from its own keys, not just the source
[Fix] utils: merge: keep a strictMerge conflict container's index and arrayLimit correct
[Fix] parse: only treat [] as array syntax when it ends the key
[Perf] decode: skip decoders when there is no percent sign (#583)
[Robustness] utils: merge: apply arrayLimit to the two-element array built for colliding values
[Robustness] parse: bound the nesting added by repeated strictMerge conflicts (credit @Yeaseen)
[Docs] document that qs and flat parsers disagree about parameter names
[Docs] clarify that throwOnLimitExceeded limits each array, not the total number of values
[Docs] clarify 6.14.1/6.15.2 parse bracket behavior change (#567, #568)
[meta] fix changelog indents
[actions] set least-privilege cache-mode
[Tests] utils: decode: add missing cases
[Tests] parse: characterize the ]= split when an = precedes any bracket group (#620)
[Tests] parse: allowDots: cover stray close brackets before a dot
[Dev Deps] update @ljharb/eslint-config, eslint, tape

lxsmnsyc/seroval (seroval)

Configuration

📅 Schedule: (in timezone Europe/Warsaw)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Update security patches [SECURITY]

39e7317

renovate Bot added dependencies Pull requests that update a dependency file renovate security labels Oct 29, 2026

renovate Bot changed the title ~~Security patches (release/2.2.0)~~ Security patches (release/2.2.0) - autoclosed Oct 29, 2026

renovate Bot closed this Oct 29, 2026

renovate Bot deleted the renovate/release/2.2.0-security-patches branch October 29, 2026 10:58

Navigation Menu

Repository navigation

Security patches (release/2.2.0) - autoclosed - #439

Security patches (release/2.2.0) - autoclosed#439
renovate[bot] wants to merge 1 commit into
release/2.2.0from
renovate/release/2.2.0-security-patches

renovate Bot commented Oct 29, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Oct 29, 2026

qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)

Details

Summary

Root Cause

Impact

Proof of Concept

Attack Chain

Bypass Evidence

Affected Versions

Suggested Fix

Independent report by @​Lucidsec

Summary

Technical Details

Impact

Proof of Concept

Suggested Fix

Severity

References

Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check

Details

Summary

Impact

Affected versions

Patches

Workarounds

Severity

References

Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)

Details

Summary

Impact

Patches

Workarounds

Severity

References

Seroval fromJSON/fromCrossJSON denial of service via unvalidated array node length

Details

Summary

Impact

Patches

Workarounds

Severity

References

Seroval: Script injection through RegExp sources in serialized output

Details

Summary

Details

Impact

Patches

Workarounds

Severity

References

Seroval: Code injection through a typed array's own constructor property

Details

Summary

Details

Impact

Patches

Workarounds

Severity

References

Release Notes

v6.16.1

v1.6.11

v1.6.10

v1.6.9

v1.6.8

Configuration

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Independent report by @Lucidsec

Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length

`v6.16.1`

`v1.6.11`

`v1.6.10`

`v1.6.9`

`v1.6.8`