CVE-2026-82562

About vulnerability

Summary

qs v6.15.3 allows bracket-key input to bypass arrayLimit and throwOnLimitExceeded when comma: true. The input a[]=1,2,3,4 succeeds with arrayLimit: 3, while the equivalent plain-key input is rejected.

Affected version tested:

qs v6.15.3
commit 18d085e919dae70c8f1b200ab99323058edab2c2

Details

parseArrayValue() enforces the comma limit only for flat values. The a[] form is marked non-flat, so its comma-separated value is wrapped after parsing and the inner array is not checked. A single parameter can therefore materialize arbitrarily large arrays.

PoC

const qs = require('qs')
const options = { comma: true, arrayLimit: 3, throwOnLimitExceeded: true }

const result = qs.parse('a[]=1,2,3,4', options)
console.log(result.a[0].length) // 4; expected RangeError

const big = qs.parse('a[]=' + '1,'.repeat(1000000) + '1', { comma: true, arrayLimit: 20 })
console.log(big.a[0].length) // 1000001

On v6.15.3, the first input parses successfully and the second creates an array with 1,000,001 elements. The equivalent a=1,2,3,4 input throws RangeError as expected.

Impact

An attacker who can supply a query string or form body can bypass configured array limits and force excessive memory allocation, causing denial of service. The limit must be applied after comma splitting and before the resulting array is wrapped.

Affected product:

@0x/subproviders , @portis/web3 , @portis/web3-provider-engine , AngularJS , Babel , Express , Node.js , React , Vue , a2a-js-sdk , adk-js , angular-animations , angular-pwa , angular-router , apollo-server , apollo-server-hapi , assetgraph , authereum , aws-cdk , babel-code-frame , babel-core , babel-generator , babel-helper-builder-react-jsx-experimental , babel-jest , babel-loader , babel-parser , babel-plugin-proposal-class-properties , babel-plugin-proposal-decorators , babel-plugin-proposal-nullish-coalescing-operator , babel-plugin-proposal-numeric-separator , babel-plugin-proposal-optional-chaining , babel-plugin-syntax-async-generators , babel-plugin-syntax-export-namespace-from , babel-plugin-syntax-logical-assignment-operators , babel-plugin-syntax-numeric-separator , babel-plugin-syntax-optional-catch-binding , babel-plugin-transform-flow-strip-types , babel-plugin-transform-object-assign , babel-plugin-transform-react-display-name , babel-plugin-transform-react-jsx , babel-preset-jest , babel-preset-react , babel-traverse , babel-types , bitcoin-core , blockstack.js , body-parser , broccoli , bull-board-api , bull-board-bun , bull-board-cli , bull-board-elysia , bull-board-express , bull-board-h3 , bull-board-hapi , bull-board-hono , bull-board-koa , bull-board-metrics , cache-loader , canvg , cbt_tunnels , celo-celocli , celo-connect , celo-contractkit , celo-dev-utils , celo-encrypted-backup , celo-explorer , celo-governance , celo-identity , celo-keystores , celo-phone-number-privacy-common , celo-utils , celo-wallet-base , celo-wallet-hsm , celo-wallet-hsm-azure , celo-wallet-hsm-gcp , celo-wallet-ledger , celo-wallet-local , celo-wallet-remote , celo-wallet-rpc , chain-jslib , co-body , colorable , combohandler , connect , core-js , core-js-builder , core-js-bundle , core-js-pure , create-react-app , create-rspeedy , create-strapi , create-strapi-app , create-yarn-workspaces , css-loader , cypress , cypress-request , developer-tooling , diff-sequences , discuz-api , docusaurus , docusaurus-core , docusaurus-plugin-content-blog , docusaurus-plugin-content-docs , docusaurus-plugin-content-pages , docusaurus-plugin-css-cascade-layers , docusaurus-plugin-debug , docusaurus-plugin-google-analytics , docusaurus-plugin-google-gtag , docusaurus-plugin-google-tag-manager , docusaurus-plugin-sitemap , docusaurus-plugin-svgr , docusaurus-theme-classic , docusaurus-theme-common , docusaurus-theme-search-algolia , ecosystem , electron , electron-download , elm , ember-cli , enzyme-matchers , esjzone-api , eth-lib , ethereumjs-client , expo , expo-app-integrity , expo-dev-client-components , expo-dev-server , expo-dev-tools , expo-electron-adapter , expo-expo-cli , expo-image , expo-linking , expo-mesh-gradient , expo-metro-config , expo-module-scripts , expo-modules-core , expo-next-adapter , expo-prebuild-config , expo-schemer , expo-screen-capture , expo-standard-web-crypto , expo-status-bar , expo-symbols , expo-xdl , extract-bad-epub , extract-css-chunks-webpack-plugin , extract-text-webpack-plugin , file-loader , firebase-functions , flmngr-flmngr-server-node , formidable , friendly-errors-webpack-plugin , ganache-core , gatsby , gatsby-cypress , gatsby-plugin-guess-js , gatsby-plugin-sharp , gatsby-plugin-subfont , gear-lib , get-css , get-pixels , gh-pages , globalart-nestjs-zod , google-adk , google-api-nodejs-client , google-cloud-functions-framework , google-cloud-opentelemetry-cloud-monitoring-exporter , google-cloud-vertexai , google-oauth2-node , googleapis-common , graphql-mesh , graphql-mesh-cache-cfw-kv , graphql-mesh-cache-file , graphql-mesh-cache-inmemory-lru , graphql-mesh-cache-localforage , graphql-mesh-cache-redis , graphql-mesh-fusion-composition , graphql-mesh-graphql , graphql-mesh-merger-stitching , graphql-mesh-mongoose , graphql-mesh-mysql , graphql-mesh-plugin-deduplicate-request , graphql-mesh-plugin-hive , graphql-mesh-plugin-http-cache , graphql-mesh-plugin-http-details-extensions , graphql-mesh-plugin-live-query , graphql-mesh-plugin-mock , graphql-mesh-plugin-newrelic , graphql-mesh-plugin-operation-field-permissions , graphql-mesh-plugin-rate-limit , graphql-mesh-plugin-response-cache , graphql-mesh-plugin-snapshot , graphql-mesh-plugin-statsd , graphql-mesh-runtime , graphql-mesh-store , graphql-mesh-transform-cache , graphql-mesh-transform-encapsulate , graphql-mesh-transform-extend , graphql-mesh-transform-federation , graphql-mesh-transform-filter-schema , graphql-mesh-transform-hive , graphql-mesh-transform-hoist-field , graphql-mesh-transform-naming-convention , graphql-mesh-transform-prefix , graphql-mesh-transform-prune , graphql-mesh-transform-rate-limit , graphql-mesh-transform-rename , graphql-mesh-transform-replace-field , graphql-mesh-transform-resolvers-composition , graphql-mesh-transform-transfer-schema , graphql-mesh-transform-type-merging , graphql-mesh-transport-mysql , graphql-mesh-transport-sqlite , graphql-mesh-transport-thrift , graphql-mesh-tuql , graphql-mesh-types , graphql-mesh-utils , grunt-karma , guess , hard-source-webpack-plugin , hiero-sdk-js , html-webpack-plugin , htmlnano , ionic-lab , ionic-v1-toolkit , istanbul-instrumenter-loader , jQuery , jest , jest-circus , jest-cli , jest-config , jest-core , jest-dev-server , jest-diff , jest-docblock , jest-editor-support , jest-environment , jest-environment-jsdom , jest-environment-jsdom-fourteen , jest-environment-node , jest-expo , jest-expo-enzyme , jest-fake-timers , jest-get-type , jest-globals , jest-haste-map , jest-jasmine2 , jest-matcher-utils , jest-message-util , jest-mock , jest-puppeteer , jest-puppeteer-pkg , jest-regex-util , jest-repl , jest-reporters , jest-resolve-dependencies , jest-runner , jest-runtime , jest-snapshot , jest-test-sequencer , jest-test-typescript-parser , jest-transform , jest-types , jest-util , jest-validate , js-genai , jsdom , jsdom-extra , jspdf , karma , karma-browserstack-launcher , karma-jasmine , karma-junit-reporter , karma-mocha-reporter , karma-requirejs , koa-body , koa-bodyparser , lazy-node-semver-ampersand , ledger-live , ledgerhq-coin-algorand , ledgerhq-coin-aptos , ledgerhq-coin-canton , ledgerhq-coin-celo , ledgerhq-coin-concordium , ledgerhq-coin-cosmos , ledgerhq-coin-framework , ledgerhq-coin-near , ledgerhq-coin-polkadot , ledgerhq-coin-tester , ledgerhq-coin-tester-bitcoin , ledgerhq-concordium-core , ledgerhq-domain-service , ledgerhq-hw-app-near , ledgerhq-hw-transport , ledgerhq-hw-transport-mocker , ledgerhq-hw-transport-node-hid-noevents , ledgerhq-hw-transport-node-speculos , ledgerhq-hw-transport-web-ble , ledgerhq-hw-transport-webusb , ledgerhq-live-cli , ledgerhq-live-common , ledgerhq-live-countervalues , ledgerhq-live-currency-format , ledgerhq-live-nft , ledgerhq-live-nft-react , ledgerjs , lerna , lerna-conventional-commits , less , libcipm , libnpm , loaders.gl , loaders.gl-arrow , loaders.gl-bson , loaders.gl-csv , loaders.gl-excel , loaders.gl-flatgeobuf , loaders.gl-geoarrow , loaders.gl-geopackage , loaders.gl-geotiff , loaders.gl-graphs , loaders.gl-i3s , loaders.gl-json , loaders.gl-kml , loaders.gl-las , loaders.gl-lerc , loaders.gl-mlt , loaders.gl-netcdf , loaders.gl-obj , loaders.gl-parquet , loaders.gl-pcd , loaders.gl-ply , loaders.gl-pmtiles , loaders.gl-polyfills , loaders.gl-potree , loaders.gl-schema-utils , loaders.gl-shapefile , loaders.gl-splats , loaders.gl-textures , loaders.gl-tile-converter , loaders.gl-traces , loaders.gl-wkt , loaders.gl-wms , loggly , loopback , loopback-connector-remote , loopback-datasource-juggler , lynx-js-react-alias-rsbuild-plugin , lynx-js-react-rsbuild-plugin , lynx-js-rspeedy , lynx-js-template-webpack-plugin , lynx-js-web-constants , lynx-js-web-core , lynx-js-web-worker-rpc , lynx-js-web-worker-runtime , lynx-stack , masiro-me-api , mdx , microsoft-365-agents-toolkit , microsoft-rush , microsoft-rush-lib , middleware , minimizer-webpack-plugin , mockttp , monorepo , nest , nestjs-common , nestjs-core , nestjs-microservices , nestjs-platform-express , nestjs-platform-fastify , nestjs-platform-socket.io , nestjs-platform-ws , nestjs-testing , netlify-cms-proxy-server , newman , ngrok , nguniversal , npm-check-updates , npm-lifecycle , npm-package-json-loader , npm-registry-client , npm:@as-integrations/express4 , npm:git-travis , npm:grover , nugget , nuxt , omnigraph-mysql , omnigraph-thrift , open-wc , open-wc-testing-karma , open-wc-testing-karma-bs , opencensus-node , opentelemetry-operations-js , optimize-css-assets-webpack-plugin , pacote , parcel-bundler , php-wasm-compile-extension , php-wasm-fs-journal , php-wasm-logger , php-wasm-node , php-wasm-node-5-2 , php-wasm-node-8-0 , php-wasm-node-8-1 , php-wasm-node-8-2 , php-wasm-node-8-4 , php-wasm-node-8-5 , php-wasm-scopes , php-wasm-stream-compression , php-wasm-universal , php-wasm-util , php-wasm-web , php-wasm-web-8-0 , php-wasm-web-8-1 , php-wasm-web-8-2 , php-wasm-web-8-3 , php-wasm-web-8-4 , php-wasm-web-8-5 , php-wasm-web-service-worker , php-wasm-xdebug-bridge , phpwind-api , postcss-loader , postgraphile , postman-request , postman-runtime , preload-webpack-plugin , probe-image-size , progress-bar-webpack-plugin , promise-core , protractor , q-io , qs , remix , remix-run-server-runtime , request , request-logger , request-promise , request-promise-native , requestretry , rsdoctor , rsdoctor-components , rsdoctor-core , rsdoctor-docs , rsdoctor-rspack-plugin , rsdoctor-sdk , rsdoctor-webpack-plugin , rules_nodejs , run-script , rushstack , rushstack-heft-web-rig , rushstack-heft-webpack4-plugin , rushstack-lockfile-explorer , rushstack-rush-amazon-s3-build-cache-plugin , rushstack-rush-azure-storage-build-cache-plugin , rushstack-rush-bridge-cache-plugin , rushstack-rush-serve-plugin , sb , script-ext-html-webpack-plugin , selleck , servify , shifter , slack-node , smooth-code/jest-puppeteer , squarelink-web3 , stacks-auth , storybook , storybook-addon-docs , storybook-angular , storybook-builder-webpack5 , storybook-cli , storybook-codemod , storybook-core-webpack , storybook-ember , storybook-html-vite , storybook-nextjs , storybook-preact , storybook-preset-react-webpack , storybook-preset-server-webpack , storybook-react , storybook-react-dom-shim , storybook-react-vite , storybook-react-webpack5 , storybook-server , storybook-server-webpack5 , storybook-vue3 , storybook-vue3-vite , storybook-vue3-webpack5 , storybook-web-components , storybook-web-components-vite , storybook-web-components-webpack5 , strapi , strapi-admin , strapi-cloud-cli , strapi-content-manager , strapi-content-releases , strapi-content-type-builder , strapi-core , strapi-data-transfer , strapi-database , strapi-email , strapi-generators , strapi-i18n , strapi-logger , strapi-openapi , strapi-permissions , strapi-plugin-cloud , strapi-plugin-documentation , strapi-plugin-graphql , strapi-plugin-sentry , strapi-plugin-users-permissions , strapi-provider-email-mailgun , strapi-provider-email-sendgrid , strapi-provider-upload-aws-s3 , strapi-provider-upload-cloudinary , strapi-provider-upload-local , strapi-review-workflows , strapi-strapi , strapi-types , strapi-typescript-utils , strapi-upgrade , strapi-upload , strapi-utils , strong-remoting , stryker-mutator-core , stryker-mutator-typescript-checker , stryker-mutator-vitest-runner , stx-labs-stacks.js , style-resources-loader , subfont , superagent , supertest , svgr , svgr-babel-plugin-add-jsx-attribute , svgr-babel-plugin-remove-jsx-empty-expression , svgr-babel-plugin-replace-jsx-attribute-value , svgr-babel-plugin-svg-em-dimensions , svgr-babel-plugin-transform-react-native-svg , svgr-babel-plugin-transform-svg-component , svgr-babel-preset , svgr-core , svgr-hast-util-to-babel-ast , svgr-plugin-jsx , svgr-plugin-prettier , svgr-plugin-svgo , swarm-js , syosetu-api , tachyons-generator , testcafe , testem , theme-ui , thread-loader , thrift-server , time-fix-plugin , tiny-lr , torus-embed , torus.js , ts-jest , tsoa-runtime , tuql , typed-rest-client , typescript-sdk , uglifyjs-webpack-plugin , uncss , upgrade-rspeedy , url , url-loader , verdaccio , verdaccio-audit , verdaccio-auth , verdaccio-test-helper , verdaccio-utils , wait-on , walletconnect-core , walletconnect-ethereum-provider , walletconnect-monorepo , walletconnect-signer-connection , walletconnect-types , walletconnect/walletconnect-monorepo , wdio-browser-runner , wdio-concise-reporter , wdio-config , wdio-firefox-profile-service , wdio-jasmine-framework , wdio-json-reporter , wdio-sauce-service , wdio-shared-store-service , wdio-smoke-test-reporter , wdio-static-server-service , wdio-sumologic-reporter , wdio-testingbot-service , wdio-utils , wdio-webdriver-mock-service , web-storybook-builder , web3 , web3-bzz , web3-core , web3-core-helpers , web3-core-method , web3-core-promievent , web3-core-requestmanager , web3-core-subscriptions , web3-eth , web3-eth-accounts , web3-eth-contract , web3-eth-ens , web3-eth-iban , web3-eth-personal , web3-net , web3-provider-engine , web3-providers-http , web3-providers-ipc , web3-providers-ws , web3-react , web3-shh , web3-utils , web3.js , web3providerengine , webdriver , webdriver-manager , webdriverio , webpack , webpack-bundle-analyzer , webpack-dev-middleware , webpack-dev-server , webpack-subresource-integrity , webpackbar , weinre2 , wenku8-api , whistle , wordpress-env , wordpress-playground , workflow , workflow-astro , workflow-builders , workflow-cli , workflow-core , workflow-nest , workflow-next , workflow-nitro , workflow-nuxt , workflow-rollup , workflow-sveltekit , workflow-vite , workflow-web , workflow-world-vercel , workspaces-config , wp-playground-blueprints , wp-playground-cli , wp-playground-common , wp-playground-components , wp-playground-mcp , wp-playground-remote , ws-jsdom-extra , ws-pkg-list , ws-rest , ws-yarn-workspaces , x402 , x402-evm , x402-express , x402-extensions , x402-hono , x402-mcp , x402-next , x402-paywall , xdl , yarn-list-link , yarn-tool-changelog , yarn-tool-fix-all , yarn-tool-fix-ws-links , yarn-tool-fix-ws-versions , yarn-tool-get-pkg-bin , yarn-tool-ncu , yarn-tool-ncu-ws , yarn-tool-node-modules-is-alias , yarn-tool-normalize-deps-value , yarn-tool-npa-to-deps , yarn-tool-npa-to-deps-query , yarn-tool-npm-package-arg-util , yarn-tool-pkg-deps-add , yarn-tool-pkg-deps-util , yarn-tool-pkg-entry-util , yarn-tool-pkg-git-info , yarn-tool-pkg-hosted-info , yarn-tool-pkg-list-to-types , yarn-tool-pkg-name-to-types , yarn-tool-pkg-version-query , yarn-tool-resolve-package , yarn-tool-sort-lerna-json , yarn-tool-version-recommended , yarn-tool-workspaces-project , yarn-tool-ws-scope , yarn-tool-yarnlock , yarn-tool-yarnlock-entries , yarn-tool-yarnlock-fs , yarn-tool-yarnlock-parse , yarn-tool-yarnlock-parse-raw , yarn-tool-yarnlock-stringify , yarn-tool-yarnlock-types , yarn-tool-yarnlock-util , yui3 , yuidoc

Affected packages:

qs @ 6.15.3 (+5685 more)