CVE-2026-82562
published 2026-08-30CVE-2026-82562: ### Summary When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is…
PriorityP420low3.7CVSS 3.1
AVNACHPRNUINSUCNINAL
EPSS
0.32%
24.4th percentile
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produces an inner array of arbitrary length even though the caller opted into the hard limit. This is the `[]=` key form that the fix for CVE-2026-2391 (qs 6.14.2) did not cover.
### Details
In `lib/parse.js`, a comma-separated value under a `[]=` key is split and then wrapped as a single nested element (`val = [val]`, so that each `a[]=x,y` group counts as one element of the outer array). The `arrayLimit` check that 6.14.2 added for comma values runs after that wrap, so for `[]=` parts it only ever saw the wrapper of length 1. 6.15.3 added a pre-split comma count so that an oversized value throws before it is allocated, but gated it on an `isFlatArrayValue` flag that `parseValues` set to `false` for any part containing `[]=`, and did not pass it for object-valued input, so the gap remained.
#### PoC
```js
var qs = require('qs');
var options = { comma: true, arrayLimit: 3, throwOnLimitExceeded: true };
qs.parse('a=1,2,3,4', options); // RangeError: Array limit exceeded. Only 3 elements allowed in an array.
qs.parse('a[]=1,2,3,4', options); // { a: [ [ '1', '2', '3', '4' ] ] } (no throw)
qs.parse('a[]=' + '1,'.repeat(1000000) + '1', { comma: true, arrayLimit: 20, throwOnLimitExceeded: true });
// no throw; a 1,000,001-element inner array is allocated
```
#### Fix
`lib/parse.js`, applied in 8859c37 on `main` and released as v6.16.0: the `isFlatArrayValue` gate is removed, so every comma-split value is counted against `arrayLimit` before splitting regardless of key form. An in-limit group undAffected
98 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 3scale-amp2 | system-rhel8 | — | — |
| advanced-cluster-security | rhacs-main-rhel8 | — | — |
| advanced-cluster-security | rhacs-main-rhel9 | — | — |
| ansible-automation-platform-24 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-26 | lightspeed-rhel9 | — | — |
| ansible-automation-platform-27 | mcp-server-rhel9 | — | — |
| ansible-automation-platform-tech-preview | mcp-server-rhel9 | — | — |
| ansible-automation-platform | automation-portal | — | — |
| ansible-automation-platform | bootc-automation-portal-rhel9 | — | — |
| clusterlabs | pcs | — | — |
| costmanagement | costmanagement-ui-rhel10 | — | — |
| cryostat | cryostat-openshift-console-plugin-rhel9 | — | — |
| debian | ceph | — | — |
| devspaces | code-rhel9 | — | — |
| devspaces | dashboard-rhel9 | — | — |
| devspaces | jetbrains-ide-rhel9 | — | — |
| devspaces | openvsx-rhel9 | — | — |
| devspaces | pluginregistry-rhel9 | — | — |
| discovery | discovery-ui-rhel9 | — | — |
| external-secrets-management | console-plugin-rhel9 | — | — |
| gatekeeper | gatekeeper-rhel9 | — | — |
| grafana | grafana | — | — |
| mta | mta-solution-server-rhel9 | — | — |
| mta | mta-ui-rhel9 | — | — |
CVSS provenance
nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
nvdv4.06.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
qs array-limit bypass via bracket-key comma parsing
ghsa·2026-09-02
CVE-2026-82562 [MEDIUM] CWE-770 qs array-limit bypass via bracket-key comma parsing
qs array-limit bypass via bracket-key comma parsing
### Summary
`qs` `v6.15.3` allows bracket-key input to bypass `arrayLimit` and `throwOnLimitExceeded` when `comma: true`. The input `a[]=1,2,3,4` succeeds with `arrayLimit: 3`, while the equivalent plain-key input is rejected.
Affected version tested:
```text
qs v6.15.3
commit 18d085e919dae70c8f1b200ab99323058edab2c2
```
### Details
`parseArrayValue()` enforces the comma limit only for flat values. The `a[]` form is marked non-flat, so its comma-separated value is wrapped after parsing and the inner array is not checked. A single parameter can therefore materialize arbitrarily large arrays.
### PoC
```js
const qs = require('qs')
const options = { comma: true, arrayLimit: 3, throwOnLimitExceeded: true }
const result = qs.parse('a[
VulDB
ljharb qs up to 6.15.x Query Parser lib/parse.js parse comma/throwOnLimitExceeded allocation of resources
vuldb·2026-08-30·CVSS 3.7
CVE-2026-82562 [LOW] ljharb qs up to 6.15.x Query Parser lib/parse.js parse comma/throwOnLimitExceeded allocation of resources
A vulnerability identified as problematic has been detected in ljharb qs up to 6.15.x. Affected is the function parse of the file lib/parse.js of the component Query Parser. Performing a manipulation of the argument comma/throwOnLimitExceeded results in allocation of resources.
This vulnerability is reported as CVE-2026-82562. The attack is possible to be carried out remotely. No exploit exists.
You should upgrade the affected component.
Red Hat
qs: qs: Denial of Service via array limit bypass in query string parsing
vendor_redhat·2026-08-29·CVSS 3.7
CVE-2026-82562 [LOW] CWE-770 qs: qs: Denial of Service via array limit bypass in query string parsing
qs: qs: Denial of Service via array limit bypass in query string parsing
A flaw was found in qs. An unauthenticated attacker can exploit this by sending a specially crafted query string to an application using `qs.parse` with specific non-default settings (`comma: true` and `throwOnLimitExceeded: true`). This bypasses a configured array limit, causing the parser to allocate an excessively large array. This can lead to a Denial of Service (DoS) by consuming too much memory.
Package: costmanagement/costmanagement-ui-rhel10 (Cost Management On Premise) - Fix deferred
Package: cryostat/cryostat-openshift-console-plugin-rhel9 (Cryostat 4) - Fix deferred
Package: gatekeeper/gatekeeper-rhel9 (Gatekeeper 3) - Fix deferred
Package: mta/mta-solution-server-rhel9 (Migration Toolkit for Applicati
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-82562 qt5-qtwebengine: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
bugzilla·2026-09-02·CVSS 7.5
CVE-2026-82562 [HIGH] CVE-2026-82562 qt5-qtwebengine: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
CVE-2026-82562 qt5-qtwebengine: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore
Bugzilla
CVE-2026-82562 fbthrift: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
bugzilla·2026-09-02·CVSS 7.5
CVE-2026-82562 [HIGH] CVE-2026-82562 fbthrift: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
CVE-2026-82562 fbthrift: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produces
Bugzilla
CVE-2026-82562 mozjs140: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
bugzilla·2026-09-02·CVSS 7.5
CVE-2026-82562 [HIGH] CVE-2026-82562 mozjs140: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
CVE-2026-82562 mozjs140: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produce
Bugzilla
CVE-2026-82562 nextcloud: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
bugzilla·2026-09-02·CVSS 7.5
CVE-2026-82562 [HIGH] CVE-2026-82562 nextcloud: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
CVE-2026-82562 nextcloud: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produc
Bugzilla
CVE-2026-82562 qt6-qtwebengine: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
bugzilla·2026-09-02·CVSS 7.5
CVE-2026-82562 [HIGH] CVE-2026-82562 qt6-qtwebengine: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
CVE-2026-82562 qt6-qtwebengine: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore pr
Bugzilla
CVE-2026-82562 magicmirror-module-onthisday: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
bugzilla·2026-09-02·CVSS 7.5
CVE-2026-82562 [HIGH] CVE-2026-82562 magicmirror-module-onthisday: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
CVE-2026-82562 magicmirror-module-onthisday: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,..
Bugzilla
CVE-2026-82562 python-torch: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
bugzilla·2026-09-02·CVSS 7.5
CVE-2026-82562 [HIGH] CVE-2026-82562 python-torch: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
CVE-2026-82562 python-torch: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produ
Bugzilla
CVE-2026-82562 nextcloud: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
bugzilla·2026-09-02·CVSS 7.5
CVE-2026-82562 [HIGH] CVE-2026-82562 nextcloud: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
CVE-2026-82562 nextcloud: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produces
Bugzilla
CVE-2026-82562 mozjs115: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
bugzilla·2026-09-02·CVSS 7.5
CVE-2026-82562 [HIGH] CVE-2026-82562 mozjs115: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
CVE-2026-82562 mozjs115: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produce
Bugzilla
CVE-2026-82562 openbao: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
bugzilla·2026-09-02·CVSS 7.5
CVE-2026-82562 [HIGH] CVE-2026-82562 openbao: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
CVE-2026-82562 openbao: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produces a
Bugzilla
CVE-2026-82562 sgx-pccs: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
bugzilla·2026-09-02·CVSS 7.5
CVE-2026-82562 [HIGH] CVE-2026-82562 sgx-pccs: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
CVE-2026-82562 sgx-pccs: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produce
Bugzilla
CVE-2026-82562 yarnpkg: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
bugzilla·2026-09-02·CVSS 7.5
CVE-2026-82562 [HIGH] CVE-2026-82562 yarnpkg: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
CVE-2026-82562 yarnpkg: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produces
Bugzilla
CVE-2026-82562 cachelib: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
bugzilla·2026-09-02·CVSS 7.5
CVE-2026-82562 [HIGH] CVE-2026-82562 cachelib: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
CVE-2026-82562 cachelib: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produces
Bugzilla
CVE-2026-82562 firefox: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
bugzilla·2026-09-02·CVSS 7.5
CVE-2026-82562 [HIGH] CVE-2026-82562 firefox: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
CVE-2026-82562 firefox: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produces
Bugzilla
CVE-2026-82562 h3: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
bugzilla·2026-09-02·CVSS 7.5
CVE-2026-82562 [HIGH] CVE-2026-82562 h3: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
CVE-2026-82562 h3: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produces an i
Bugzilla
CVE-2026-82562 seamonkey: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
bugzilla·2026-09-02·CVSS 7.5
CVE-2026-82562 [HIGH] CVE-2026-82562 seamonkey: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
CVE-2026-82562 seamonkey: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produc
Bugzilla
CVE-2026-82562 trivy: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
bugzilla·2026-09-02·CVSS 7.5
CVE-2026-82562 [HIGH] CVE-2026-82562 trivy: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
CVE-2026-82562 trivy: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produces an
Bugzilla
CVE-2026-82562 python-torch: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
bugzilla·2026-09-02·CVSS 7.5
CVE-2026-82562 [HIGH] CVE-2026-82562 python-torch: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
CVE-2026-82562 python-torch: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore pro
Bugzilla
CVE-2026-82562 thunderbird: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
bugzilla·2026-09-02·CVSS 7.5
CVE-2026-82562 [HIGH] CVE-2026-82562 thunderbird: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
CVE-2026-82562 thunderbird: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore prod
Bugzilla
CVE-2026-82562 fcitx5: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
bugzilla·2026-09-02·CVSS 7.5
CVE-2026-82562 [HIGH] CVE-2026-82562 fcitx5: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
CVE-2026-82562 fcitx5: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produces
Bugzilla
CVE-2026-82562 fbthrift: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
bugzilla·2026-09-02·CVSS 7.5
CVE-2026-82562 [HIGH] CVE-2026-82562 fbthrift: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
CVE-2026-82562 fbthrift: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produce
Bugzilla
CVE-2026-82562 openbao: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
bugzilla·2026-09-02·CVSS 7.5
CVE-2026-82562 [HIGH] CVE-2026-82562 openbao: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
CVE-2026-82562 openbao: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produces
Bugzilla
CVE-2026-82562 seamonkey: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
bugzilla·2026-09-02·CVSS 7.5
CVE-2026-82562 [HIGH] CVE-2026-82562 seamonkey: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
CVE-2026-82562 seamonkey: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produces
Bugzilla
CVE-2026-82562 magicmirror: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
bugzilla·2026-09-02·CVSS 7.5
CVE-2026-82562 [HIGH] CVE-2026-82562 magicmirror: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
CVE-2026-82562 magicmirror: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produc
Bugzilla
CVE-2026-82562 magicmirror: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
bugzilla·2026-09-02·CVSS 7.5
CVE-2026-82562 [HIGH] CVE-2026-82562 magicmirror: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
CVE-2026-82562 magicmirror: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore prod
Bugzilla
CVE-2026-82562 yarnpkg: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
bugzilla·2026-09-02·CVSS 7.5
CVE-2026-82562 [HIGH] CVE-2026-82562 yarnpkg: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
CVE-2026-82562 yarnpkg: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produces a
Bugzilla
CVE-2026-82562 cachelib: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
bugzilla·2026-09-02·CVSS 7.5
CVE-2026-82562 [HIGH] CVE-2026-82562 cachelib: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
CVE-2026-82562 cachelib: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produce
Bugzilla
CVE-2026-82562 mozjs128: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
bugzilla·2026-09-02·CVSS 7.5
CVE-2026-82562 [HIGH] CVE-2026-82562 mozjs128: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
CVE-2026-82562 mozjs128: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produce
Bugzilla
CVE-2026-82562 mozjs78: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
bugzilla·2026-09-02·CVSS 7.5
CVE-2026-82562 [HIGH] CVE-2026-82562 mozjs78: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
CVE-2026-82562 mozjs78: qs: Denial of Service via array limit bypass in query string parsing [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produces a
Bugzilla
CVE-2026-82562 icecat: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
bugzilla·2026-09-02·CVSS 7.5
CVE-2026-82562 [HIGH] CVE-2026-82562 icecat: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
CVE-2026-82562 icecat: qs: Denial of Service via array limit bypass in query string parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produces
Bugzilla
CVE-2026-82562 qs: qs: Denial of Service via array limit bypass in query string parsing
bugzilla·2026-08-30·CVSS 7.5
CVE-2026-82562 [HIGH] CVE-2026-82562 qs: qs: Denial of Service via array limit bypass in query string parsing
CVE-2026-82562 qs: qs: Denial of Service via array limit bypass in query string parsing
### Summary
When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produces an inner array of arbitrary length even though the caller opted into the hard limit. This is the `[]=` key form that the fix for CVE-2026-2391 (qs 6.14.2) did not cover.
### Details
In `lib/parse.js`, a comma-separated value under a `[]=`
2026-08-30
Published