Qs
Monthly
Query string parameter injection in the npm qs library: when an application calls qs.stringify with the non-default option allowEmptyArrays: true, the key of an empty array is emitted without encoding, so an attacker-influenced key containing &, =, # or the configured delimiter becomes query string syntax rather than data - letting the caller add parameters to the serialized query string or truncate it at a fragment. All releases from 6.12.0 through 6.16.1 are affected (allowEmptyArrays did not exist before 6.12.0); the issue only bites when untrusted key names reach stringify and at least one of them maps to an empty array, and deployments that leave the option at its default are unaffected. The vendor has released patches in 6.12.6, 6.13.4, 6.14.3, 6.15.4, 6.16.2 and 6.17.0; EPSS is low at 0.23% (14th percentile), there is no CISA KEV entry, and the advisory includes a public PoC reference that is not verified as working exploit code. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) rates impact as integrity-only and modest.
Comma-split value parsing in the qs npm library (versions 6.14.2 through 6.15.3) bypasses the caller-configured `arrayLimit` when the bracket-push key form (`a[]=`) is combined with both `comma: true` and `throwOnLimitExceeded: true` options. An `isFlatArrayValue` flag in `parseArrayValue` incorrectly excluded `[]=` key forms from the pre-split comma count check introduced by the CVE-2026-2391 patch, allowing a single crafted parameter to allocate an arbitrarily large inner array while the documented limit silently fails open. A proof-of-concept is confirmed in the vendor advisory; the CVE is not listed in CISA KEV and no active exploitation has been confirmed. The fix ships in v6.16.0 via commit 8859c37.
### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. [CVSS 3.7 LOW]
Memory and availability pressure in the npm package qs (versions before 6.14.1) stems from an input-validation gap where the arrayLimit parse option is enforced for indexed array notation (a[0]=1) but not for bracket notation (a[]=1), letting attackers control how many array elements are materialized for a single key from an attacker-supplied query string. Exploitation requires a non-default configuration: the application must use qs to parse attacker-controlled query strings with parseArrays enabled (the default) and, critically, parameterLimit explicitly raised well above its default of 1000, because parameterLimit independently caps total parsed parameters and neutralizes the issue under default settings. Unauthenticated remote attackers face no user interaction, but impact is bounded to low availability/memory pressure rather than code execution; publicly available exploit code exists (PoC in vendor advisory GHSA-6rw7-vpxm-498p), a vendor patch is available in qs 6.14.1, and EPSS is only 0.45% (37th percentile), consistent with the vendor's own severity downgrade.
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Query string parameter injection in the npm qs library: when an application calls qs.stringify with the non-default option allowEmptyArrays: true, the key of an empty array is emitted without encoding, so an attacker-influenced key containing &, =, # or the configured delimiter becomes query string syntax rather than data - letting the caller add parameters to the serialized query string or truncate it at a fragment. All releases from 6.12.0 through 6.16.1 are affected (allowEmptyArrays did not exist before 6.12.0); the issue only bites when untrusted key names reach stringify and at least one of them maps to an empty array, and deployments that leave the option at its default are unaffected. The vendor has released patches in 6.12.6, 6.13.4, 6.14.3, 6.15.4, 6.16.2 and 6.17.0; EPSS is low at 0.23% (14th percentile), there is no CISA KEV entry, and the advisory includes a public PoC reference that is not verified as working exploit code. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) rates impact as integrity-only and modest.
Comma-split value parsing in the qs npm library (versions 6.14.2 through 6.15.3) bypasses the caller-configured `arrayLimit` when the bracket-push key form (`a[]=`) is combined with both `comma: true` and `throwOnLimitExceeded: true` options. An `isFlatArrayValue` flag in `parseArrayValue` incorrectly excluded `[]=` key forms from the pre-split comma count check introduced by the CVE-2026-2391 patch, allowing a single crafted parameter to allocate an arbitrarily large inner array while the documented limit silently fails open. A proof-of-concept is confirmed in the vendor advisory; the CVE is not listed in CISA KEV and no active exploitation has been confirmed. The fix ships in v6.16.0 via commit 8859c37.
### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. [CVSS 3.7 LOW]
Memory and availability pressure in the npm package qs (versions before 6.14.1) stems from an input-validation gap where the arrayLimit parse option is enforced for indexed array notation (a[0]=1) but not for bracket notation (a[]=1), letting attackers control how many array elements are materialized for a single key from an attacker-supplied query string. Exploitation requires a non-default configuration: the application must use qs to parse attacker-controlled query strings with parseArrays enabled (the default) and, critically, parameterLimit explicitly raised well above its default of 1000, because parameterLimit independently caps total parsed parameters and neutralizes the issue under default settings. Unauthenticated remote attackers face no user interaction, but impact is bounded to low availability/memory pressure rather than code execution; publicly available exploit code exists (PoC in vendor advisory GHSA-6rw7-vpxm-498p), a vendor patch is available in qs 6.14.1, and EPSS is only 0.45% (37th percentile), consistent with the vendor's own severity downgrade.
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.