Executive brief
The npm qs library is a query string parser widely used in Node.js applications to parse URL parameters and form data. A flaw in versions 6.14.2 through 6.15.3 allows attackers to bypass configured memory limits by supplying specially crafted query strings with bracket notation. An attacker can trigger excessive memory allocation through a single malicious parameter, causing the application to crash or hang and denying service to legitimate users.
Technical details
The vulnerability is an improper resource allocation flaw (CWE-770) in the qs library's parseArrayValue() function. When the `comma: true` option is enabled, the parser splits comma-separated values into arrays and enforces an `arrayLimit` to prevent denial of service. However, the limit check is only applied to "flat" values (plain keys like `a=1,2,3`). For "non-flat" bracket-key inputs (like `a[]=1,2,3`), the comma-separated value is parsed and wrapped after the split, bypassing the limit check entirely. An attacker can supply a single parameter like `a[]=1,2,3,4` (or much larger comma-separated lists) to create arbitrarily large arrays and exhaust memory. The vulnerability requires the application to have configured the `comma: true` parsing option, but no authentication or user interaction is needed beyond sending a crafted query string or form body. The fix is included in version 6.16.0, which applies the array limit after comma splitting and before wrapping.
Affected products
- npm qs 6.14.2 through 6.15.3
Timeline
- 2026-09-02: disclosed: Published in GitHub Advisory Database
- 2026-09-02: patched: Fixed in version 6.16.0