Executive brief
qs is a popular URL query string parsing library used in many Node.js applications. The library failed to enforce its arrayLimit configuration setting when parsing array parameters using bracket notation (e.g., `a[]=1&a[]=2`), creating a denial-of-service risk through memory exhaustion. While the default configuration settings provide partial mitigation, applications that explicitly increase the parameterLimit setting could be vulnerable to DoS attacks.
Technical details
The vulnerability is an input validation bypass in qs's array parameter parsing logic. The arrayLimit option is intended to cap the maximum size of parsed arrays, but the code path handling bracket notation (e.g., `a[]=value`) at lib/parse.js:159-162 bypasses this limit by calling utils.combine() without validation, while indexed notation (e.g., `a[0]=value`) correctly enforces the limit at line 175. An attacker can craft a query string with arbitrary numbers of bracket-notation array parameters to exceed the configured arrayLimit and exhaust server memory. The practical impact is mitigated when using default settings because the default parameterLimit of 1,000 caps total parsed parameters; however, risk escalates significantly when parameterLimit is explicitly configured to higher values. The fix is available in qs 6.14.1 and later.
Affected products
- npm qs < 6.14.1
Timeline
- 2025-12-29: disclosed
- 2025-12-29: patched: Version 6.14.1 released