CVE-2026-82562

Name of the Vulnerable Software and Affected Versions qs versions 6.14.2 through 6.15.3

Description When the qs.parse function is used with the comma and throwOnLimitExceeded options set to true, a comma-separated value assigned to a bracket-push key (e.g., a[]=1,2,3,4) is split into an array without being validated against the arrayLimit. In contrast, the same value assigned to flat, indexed, nested, or dotted keys correctly triggers a RangeError. This occurs because the arrayLimit check in lib/parse.js was applied after the value was wrapped as a nested element, and a subsequent attempt to fix this using an isFlatArrayValue flag failed to account for the []= key form. An unauthenticated attacker can exploit this by providing a single a[]= parameter to bypass configured limits and force the parser to allocate an array proportional to the request size, potentially leading to excessive memory consumption.

Recommendations Update qs to version 6.16.0. As a temporary workaround, avoid using the []= key form in query strings when comma and throwOnLimitExceeded are enabled.