cbcvebase.
CVE-2026-82562
published 2026-08-30

CVE-2026-82562: ### Summary When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is…

PriorityP420low3.7CVSS 3.1
AVNACHPRNUINSUCNINAL
EPSS
0.32%
24.4th percentile
### Summary


When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produces an inner array of arbitrary length even though the caller opted into the hard limit. This is the `[]=` key form that the fix for CVE-2026-2391 (qs 6.14.2) did not cover.


### Details


In `lib/parse.js`, a comma-separated value under a `[]=` key is split and then wrapped as a single nested element (`val = [val]`, so that each `a[]=x,y` group counts as one element of the outer array). The `arrayLimit` check that 6.14.2 added for comma values runs after that wrap, so for `[]=` parts it only ever saw the wrapper of length 1. 6.15.3 added a pre-split comma count so that an oversized value throws before it is allocated, but gated it on an `isFlatArrayValue` flag that `parseValues` set to `false` for any part containing `[]=`, and did not pass it for object-valued input, so the gap remained.


#### PoC


```js


var qs = require('qs');


var options = { comma: true, arrayLimit: 3, throwOnLimitExceeded: true };


qs.parse('a=1,2,3,4', options); // RangeError: Array limit exceeded. Only 3 elements allowed in an array.


qs.parse('a[]=1,2,3,4', options); // { a: [ [ '1', '2', '3', '4' ] ] } (no throw)


qs.parse('a[]=' + '1,'.repeat(1000000) + '1', { comma: true, arrayLimit: 20, throwOnLimitExceeded: true });


// no throw; a 1,000,001-element inner array is allocated


```


#### Fix


`lib/parse.js`, applied in 8859c37 on `main` and released as v6.16.0: the `isFlatArrayValue` gate is removed, so every comma-split value is counted against `arrayLimit` before splitting regardless of key form. An in-limit group und

Affected

98 ranges· showing 25
VendorProductVersion rangeFixed in
3scale-amp2system-rhel8
advanced-cluster-securityrhacs-main-rhel8
advanced-cluster-securityrhacs-main-rhel9
ansible-automation-platform-24lightspeed-rhel8
ansible-automation-platform-25lightspeed-rhel8
ansible-automation-platform-26lightspeed-rhel9
ansible-automation-platform-27mcp-server-rhel9
ansible-automation-platform-tech-previewmcp-server-rhel9
ansible-automation-platformautomation-portal
ansible-automation-platformbootc-automation-portal-rhel9
clusterlabspcs
costmanagementcostmanagement-ui-rhel10
cryostatcryostat-openshift-console-plugin-rhel9
debianceph
devspacescode-rhel9
devspacesdashboard-rhel9
devspacesjetbrains-ide-rhel9
devspacesopenvsx-rhel9
devspacespluginregistry-rhel9
discoverydiscovery-ui-rhel9
external-secrets-managementconsole-plugin-rhel9
gatekeepergatekeeper-rhel9
grafanagrafana
mtamta-solution-server-rhel9
mtamta-ui-rhel9

CVSS provenance

nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
nvdv4.06.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat3.7LOW
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.