Qs
Monthly
Comma-split value parsing in the qs npm library (versions 6.14.2 through 6.15.3) bypasses the caller-configured `arrayLimit` when the bracket-push key form (`a[]=`) is combined with both `comma: true` and `throwOnLimitExceeded: true` options. An `isFlatArrayValue` flag in `parseArrayValue` incorrectly excluded `[]=` key forms from the pre-split comma count check introduced by the CVE-2026-2391 patch, allowing a single crafted parameter to allocate an arbitrarily large inner array while the documented limit silently fails open. A proof-of-concept is confirmed in the vendor advisory; the CVE is not listed in CISA KEV and no active exploitation has been confirmed. The fix ships in v6.16.0 via commit 8859c37.
### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. [CVSS 3.7 LOW]
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Comma-split value parsing in the qs npm library (versions 6.14.2 through 6.15.3) bypasses the caller-configured `arrayLimit` when the bracket-push key form (`a[]=`) is combined with both `comma: true` and `throwOnLimitExceeded: true` options. An `isFlatArrayValue` flag in `parseArrayValue` incorrectly excluded `[]=` key forms from the pre-split comma count check introduced by the CVE-2026-2391 patch, allowing a single crafted parameter to allocate an arbitrarily large inner array while the documented limit silently fails open. A proof-of-concept is confirmed in the vendor advisory; the CVE is not listed in CISA KEV and no active exploitation has been confirmed. The fix ships in v6.16.0 via commit 8859c37.
### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. [CVSS 3.7 LOW]
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.