CVE-2026-110910 — qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection

When the allowEmptyArrays option is used, qs.stringify does not encode the keys of empty arrays, allowing query string parameter injection.