Skip to main content

Improper Input Validation in org.webjars.npm:qs

CVE-2026-2391

  • org.webjars.npm:qs
  • qs
Medium
6.3/10

Summary

The "arrayLimit" option in qs versions from 6.7.0 through 6.14.1 does not enforce limits for comma-separated values when "comma: true" is enabled, allowing attackers to cause Denial-of-Service (DoS) via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in CVE-2025-15284.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-20 - Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References

Advisory Timeline

  • Published