{"id":"GHSA-x5fp-wj9c-mxmx","summary":"qs array-limit bypass via bracket-key comma parsing","details":"### Summary\n\n`qs` `v6.15.3` allows bracket-key input to bypass `arrayLimit` and `throwOnLimitExceeded` when `comma: true`. The input `a[]=1,2,3,4` succeeds with `arrayLimit: 3`, while the equivalent plain-key input is rejected.\n\nAffected version tested:\n\n```text\nqs v6.15.3\ncommit 18d085e919dae70c8f1b200ab99323058edab2c2\n```\n\n### Details\n\n`parseArrayValue()` enforces the comma limit only for flat values. The `a[]` form is marked non-flat, so its comma-separated value is wrapped after parsing and the inner array is not checked. A single parameter can therefore materialize arbitrarily large arrays.\n\n### PoC\n\n```js\nconst qs = require('qs')\nconst options = { comma: true, arrayLimit: 3, throwOnLimitExceeded: true }\n\nconst result = qs.parse('a[]=1,2,3,4', options)\nconsole.log(result.a[0].length) // 4; expected RangeError\n\nconst big = qs.parse('a[]=' + '1,'.repeat(1000000) + '1', { comma: true, arrayLimit: 20 })\nconsole.log(big.a[0].length) // 1000001\n```\n\nOn `v6.15.3`, the first input parses successfully and the second creates an array with 1,000,001 elements. The equivalent `a=1,2,3,4` input throws `RangeError` as expected.\n\n### Impact\n\nAn attacker who can supply a query string or form body can bypass configured array limits and force excessive memory allocation, causing denial of service. The limit must be applied after comma splitting and before the resulting array is wrapped.","aliases":["CVE-2026-82562"],"modified":"2026-09-02T15:11:03.134202Z","published":"2026-09-02T14:46:57Z","related":["CVE-2026-82562"],"database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-09-02T14:46:57Z","nvd_published_at":"2026-08-30T01:20:32Z","cwe_ids":["CWE-770"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883"},{"type":"WEB","url":"https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82562"},{"type":"WEB","url":"https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464"},{"type":"PACKAGE","url":"https://github.com/ljharb/qs"}],"affected":[{"package":{"name":"qs","ecosystem":"npm","purl":"pkg:npm/qs"},"ranges":[{"type":"SEMVER","events":[{"introduced":"6.14.2"},{"fixed":"6.16.0"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 6.15.3","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-x5fp-wj9c-mxmx/GHSA-x5fp-wj9c-mxmx.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}