Executive brief
The npm qs library is widely used to parse URL query strings in web applications. When the comma parsing option is enabled, attackers can bypass the array size limit and cause memory exhaustion on the server, resulting in denial of service. An attacker sends a single malicious URL parameter with thousands of comma-separated values, forcing the application to allocate massive arrays that exhaust available memory.
Technical details
The vulnerability is a logic flaw in the comma-splitting code path of qs's parseArrayValue function. When comma option is enabled, the library splits comma-separated strings into arrays before enforcing the arrayLimit check, allowing unbounded array growth. The vulnerable code immediately returns val.split(',') without validating the resulting array length against the configured arrayLimit (default 20), enabling creation of arbitrarily large arrays from a single query parameter. An attacker can craft a payload like ?param=,,,... with thousands of commas to trigger memory exhaustion. The attack requires the application to explicitly enable comma: true option (non-default), but no authentication or user interaction is needed. A patch is available in version 6.14.2.
Affected products
- npm qs 6.7.0 through 6.14.1
Timeline
- 2026-02-12: disclosed
- 2026-02-12: patched: Fixed in version 6.14.2