CVE-2026-8723: Root-Cause Fix for qs stringify Null/Undefined DoS

Vulnerability

CVE-2026-8723 describes a configuration-dependent synchronous denial of service in qs.stringify. Under the combination of arrayFormat: 'comma' and encodeValuesOnly: true, array elements were mapped through the encoder without guarding nullish values. If attacker-controlled input included null or undefined entries, the encoder path could receive those raw values and raise a TypeError, terminating the request flow and potentially crashing the hosting Node.js process depending on exception handling. The issue is also tracked in the CVE record.

The vulnerable logic shown in the referenced commit applied the encoder directly to every mapped element in the comma-array serialization path:

obj = utils.maybeMap(obj, encoder);

That behavior is unsafe because nullish array members are semantically meaningful in qs serialization and should not be forced through an encoder that expects a stringifiable scalar. The bug is therefore a missing input guard at the point where array elements are normalized for comma-joined output.

Patch

The fix in commit 21f80b33e5c8b3f7eba1034fff0da4a4a37a1d41 replaces the unconditional encoder mapping with a null-preserving wrapper:

obj = utils.maybeMap(obj, function (v) {
                return v == null ? v : encoder(v);
            });

This is the critical change. It preserves null and undefined as-is during the mapping phase, allowing downstream stringify logic to apply existing null semantics such as empty values, strictNullHandling, or skipNulls instead of crashing early in the encoder.

The patch also adds regression coverage in test/stringify.js for:

• [null, 'b'] and [undefined, 'b'] with arrayFormat: 'comma' and encodeValuesOnly: true
• single-element null arrays
• interaction with strictNullHandling
• interaction with skipNulls

The eslint adjustment allowing == null is consistent with the implementation choice, since that idiom intentionally matches both null and undefined.

Review

Pros

• The patch addresses the root fault line directly: nullish values are no longer passed into encoder in the affected code path.
• The fix is minimal and low-risk. It changes only the mapping behavior for nullish values and leaves non-null encoding unchanged.
• The use of v == null is technically appropriate here because the vulnerability concerns both null and undefined.
• Regression tests are well targeted and verify both non-crash behavior and output semantics, reducing the chance of a silent behavioral regression.
• The tests confirm compatibility with existing option semantics such as strictNullHandling and skipNulls, which is important for a serialization library.

Cons

• The test coverage shown is focused on the reported configuration and does not demonstrate broader fuzzing or property-based coverage for other encoder/custom-encoder combinations.
• The patch is narrowly scoped to the observed crash path; the commit excerpt does not show any broader audit of other stringify branches that may also pass unexpected values into user-provided encoders.
• The fix relies on downstream logic to preserve intended null semantics. That is correct for this code path, but it means correctness still depends on those later branches remaining stable.

Verdict

Root-cause.

This patch fixes the actual defect rather than masking the exception. The vulnerable behavior was unconditional encoder invocation on array elements in the comma-format path; the patch changes that contract so nullish values bypass encoding and continue through the serializer's established null-handling logic. The added tests validate both crash prevention and expected output, which is strong evidence that the change is complete for the reported issue. Based on the supplied sources, this is an appropriate and technically sound remediation for CVE-2026-8723.