[afoote-mitre]

Summary

Update the existing qs override from 6.16.0 to 6.16.2 to remediate CVE-2026-110816 (GHSA-6pq8-jhm2-2vcw). The patched release is applied consistently to the transitive copies used by Express and body-parser.

Why This Change Is Needed

The affected qs.stringify comma-array serialization path can throw when processing array elements that cannot be converted to strings. The application does not directly use that serialization option, so a reachable exploit path has not been established; replacing the vulnerable dependency still removes the affected library version from the runtime image. Version 6.16.2 includes the security fix released in 6.16.1 and a subsequent patch-level encoding correction.

The same offline scanner detects the advisory in the baseline image with qs@6.16.0 and does not detect it in the rebuilt image with qs@6.16.2. Deployment and a fresh Wiz scan are required to clear findings against existing deployed images.

Changes And Primary Files

Change	Primary file	Reason
Pin the existing override to qs@6.16.2	package.json	Ensure all applicable transitive consumers use the patched release.
Refresh the resolved package version, URL, and integrity hash	package-lock.json	Make clean installations and container builds reproducible.

No application behavior, project version, infrastructure configuration, or deployment changes are included.