Fcmam5

**Name of the Vulnerable Software and Affected Versions** qs versions 6.14.2 through 6.15.3 **Description** When the `qs.parse` function is used with the `comma` and `throwOnLimitExceeded` options set to `true`, a comma-separated value assigned to a bracket-push key (e.g., `a[]=1,2,3,4`) is split into an array without being validated against the `arrayLimit`. In contrast, the same value assigned to flat, indexed, nested, or dotted keys correctly triggers a `RangeError`. This occurs because the `arrayLimit` check in `lib/parse.js` was applied after the value was wrapped as a nested element, and a subsequent attempt to fix this using an `isFlatArrayValue` flag failed to account for the `[]=` key form. An unauthenticated attacker can exploit this by providing a single `a[]=` parameter to bypass configured limits and force the parser to allocate an array proportional to the request size, potentially leading to excessive memory consumption. **Recommendations** Update qs to version 6.16.0. As a temporary workaround, avoid using the `[]=` key form in query strings when `comma` and `throwOnLimitExceeded` are enabled.