CVE-2026-82562

*** Pendiente de traducción *** ### Summary<br /> <br /> <br /> <br /> When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produces an inner array of arbitrary length even though the caller opted into the hard limit. This is the `[]=` key form that the fix for CVE-2026-2391 (qs 6.14.2) did not cover.<br /> <br /> <br /> <br /> ### Details<br /> <br /> <br /> <br /> In `lib/parse.js`, a comma-separated value under a `[]=` key is split and then wrapped as a single nested element (`val = [val]`, so that each `a[]=x,y` group counts as one element of the outer array). The `arrayLimit` check that 6.14.2 added for comma values runs after that wrap, so for `[]=` parts it only ever saw the wrapper of length 1. 6.15.3 added a pre-split comma count so that an oversized value throws before it is allocated, but gated it on an `isFlatArrayValue` flag that `parseValues` set to `false` for any part containing `[]=`, and did not pass it for object-valued input, so the gap remained.<br /> <br /> <br /> <br /> #### PoC<br /> <br /> <br /> <br /> ```js<br /> <br /> <br /> <br /> var qs = require(&amp;#39;qs&amp;#39;);<br /> <br /> <br /> <br /> var options = { comma: true, arrayLimit: 3, throwOnLimitExceeded: true };<br /> <br /> <br /> <br /> qs.parse(&amp;#39;a=1,2,3,4&amp;#39;, options); // RangeError: Array limit exceeded. Only 3 elements allowed in an array.<br /> <br /> <br /> <br /> qs.parse(&amp;#39;a[]=1,2,3,4&amp;#39;, options); // { a: [ [ &amp;#39;1&amp;#39;, &amp;#39;2&amp;#39;, &amp;#39;3&amp;#39;, &amp;#39;4&amp;#39; ] ] } (no throw)<br /> <br /> <br /> <br /> qs.parse(&amp;#39;a[]=&amp;#39; + &amp;#39;1,&amp;#39;.repeat(1000000) + &amp;#39;1&amp;#39;, { comma: true, arrayLimit: 20, throwOnLimitExceeded: true });<br /> <br /> <br /> <br /> // no throw; a 1,000,001-element inner array is allocated<br /> <br /> <br /> <br /> ```<br /> <br /> <br /> <br /> #### Fix<br /> <br /> <br /> <br /> `lib/parse.js`, applied in 8859c37 on `main` and released as v6.16.0: the `isFlatArrayValue` gate is removed, so every comma-split value is counted against `arrayLimit` before splitting regardless of key form. An in-limit group under `a[]=` still counts as one element of the outer array, and the default (`throwOnLimitExceeded: false`) path is unchanged.<br /> <br /> <br /> <br /> ### Affected versions<br /> <br /> <br /> <br /> `&gt;=6.14.2