Ljharb

**Name of the Vulnerable Software and Affected Versions** qs versions 2.2.5 through 6.15.3 **Description** The `qs.stringify` function can throw a `TypeError` when serializing an object that contains a `constructor` property with a truthy, non-callable `isBuffer` member. This occurs because the `utils.isBuffer()` function performs duck-typing by invoking `obj.constructor.isBuffer(obj)` without first verifying that `isBuffer` is actually a function. An attacker can trigger this by providing specially crafted input via `qs.parse` (using `plainObjects: true` or `allowPrototypes: true`) or through `JSON.parse`. In environments like Express 4 or body-parser with `extended: true`, such input can be passed directly through `req.query` or `req.body`. This can lead to a denial of service where the affected request returns a 500 error, or in cases where the call occurs outside an error boundary (such as in an `async` handler), it may cause the entire process to exit. **Recommendations** Update qs to version 6.16.0 or later.

**Name of the Vulnerable Software and Affected Versions** shell-quote versions prior to 1.8.5 **Description** The `parse()` function finalizes parsed tokens using `Array.prototype.concat` as a reduce accumulator, which causes the entire growing array to be reallocated and copied during every iteration. This results in quadratic time complexity relative to the number of input tokens. An attacker providing a controlled string to any code path that calls `parse()` can block the single-threaded Node.js event loop for an extended period, leading to a denial of service. This issue affects availability and does not allow for code execution or data disclosure. **Recommendations** Update to version 1.8.5.

**Name of the Vulnerable Software and Affected Versions** form-data versions prior to 2.5.6 form-data versions prior to 3.0.5 form-data versions prior to 4.0.6 **Description** The `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (") characters. This allows an attacker to perform CRLF injection (Carriage Return Line Feed injection), which is the process of inserting special characters to manipulate the structure of an HTTP header. If an application uses untrusted input as a field name or filename, an attacker can terminate the header line to inject additional headers or smuggle entire multipart parts into the request forwarded to a backend. This can enable the attacker to add or override form fields, such as setting `is admin=true`, as seen by the downstream parser. **Recommendations** Update to version 2.5.6. Update to version 3.0.5. Update to version 4.0.6.

**Name of the Vulnerable Software and Affected Versions** qs versions 6.14.2 through 6.15.3 **Description** When the `qs.parse` function is used with the `comma` and `throwOnLimitExceeded` options set to `true`, a comma-separated value assigned to a bracket-push key (e.g., `a[]=1,2,3,4`) is split into an array without being validated against the `arrayLimit`. In contrast, the same value assigned to flat, indexed, nested, or dotted keys correctly triggers a `RangeError`. This occurs because the `arrayLimit` check in `lib/parse.js` was applied after the value was wrapped as a nested element, and a subsequent attempt to fix this using an `isFlatArrayValue` flag failed to account for the `[]=` key form. An unauthenticated attacker can exploit this by providing a single `a[]=` parameter to bypass configured limits and force the parser to allocate an array proportional to the request size, potentially leading to excessive memory consumption. **Recommendations** Update qs to version 6.16.0. As a temporary workaround, avoid using the `[]=` key form in query strings when `comma` and `throwOnLimitExceeded` are enabled.