CVE ID : CVE-2026-2391<\/p>\n
Published : Feb. 12, 2026, 5:17 a.m. | 1\u00a0hour, 8\u00a0minutes ago<\/p>\n
Description : ### Summary
\nThe `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).<\/p>\n
### Details
\nWhen the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?param=a,b,c` becomes `[‘a’, ‘b’, ‘c’]`). However, the limit check for `arrayLimit` (default: 20) and the optional throwOnLimitExceeded occur after the comma-handling logic in `parseArrayValue`, enabling a bypass. This permits creation of arbitrarily large arrays from a single parameter, leading to excessive memory allocation.<\/p>\n
**Vulnerable code** (lib\/parse.js: lines ~40-50):
\n“`js
\nif (val && typeof val === ‘string’ && options.comma && val.indexOf(‘,’) > -1) {
\n\u00a0 \u00a0 return val.split(‘,’);
\n}<\/p>\n
if (options.throwOnLimitExceeded && currentArrayLength >= options.arrayLimit) {
\n\u00a0 \u00a0 throw new RangeError(‘Array limit exceeded. Only ‘ + options.arrayLimit + ‘ element’ + (options.arrayLimit === 1 ? ” : ‘s’) + ‘ allowed in an array.’);
\n}<\/p>\n
return val;
\n“`
\nThe `split(‘,’)` returns the array immediately, skipping the subsequent limit check. Downstream merging via `utils.combine` does not prevent allocation, even if it marks overflows for sparse arrays.This discrepancy allows attackers to send a single parameter with millions of commas (e.g., `?param=,,,,,,,,…`), allocating massive arrays in memory without triggering limits. It bypasses the intent of `arrayLimit`, which is enforced correctly for indexed (`a[0]=`) and bracket (`a[]=`) notations (the latter fixed in v6.14.1 per GHSA-6rw7-vpxm-498p).<\/p>\n
### PoC
\n**Test 1 – Basic bypass:**
\n“`
\nnpm install qs
\n“`<\/p>\n
“`js
\nconst qs = require(‘qs’);<\/p>\n
const payload = ‘a=’ + ‘,’.repeat(25); \/\/ 26 elements after split (bypasses arrayLimit: 5)
\nconst options = { comma: true, arrayLimit: 5, throwOnLimitExceeded: true };<\/p>\n
try {
\n\u00a0 const result = qs.parse(payload, options);
\n\u00a0 console.log(result.a.length); \/\/ Outputs: 26 (bypass successful)
\n} catch (e) {
\n\u00a0 console.log(‘Limit enforced:’, e.message); \/\/ Not thrown
\n}
\n“`
\n**Configuration:**
\n– `comma: true`
\n– `arrayLimit: 5`
\n– `throwOnLimitExceeded: true`<\/p>\n
Expected: Throws “Array limit exceeded” error.
\nActual: Parses successfully, creating an array of length 26.<\/p>\n
### Impact
\nDenial of Service (DoS) via memory exhaustion.<\/p>\n
Severity: 6.3 | MEDIUM<\/p>\n
Visit the link for more details, such as CVSS details, affected products, timeline, and more…\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"
CVE ID : CVE-2026-2391 Published : Feb. 12, 2026, 5:17 a.m. | 1\u00a0hour, 8\u00a0minutes ago Description : ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-76981","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/76981","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=76981"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/76981\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=76981"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=76981"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=76981"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}