CVE-2026-82562
Description
A flaw was found in qs. An unauthenticated attacker can exploit this by sending a specially crafted query string to an application using qs.parse with specific non-default settings (comma: true and throwOnLimitExceeded: true). This bypasses a configured array limit, causing the parser to allocate an excessively large array. This can lead to a Denial of Service (DoS) by consuming too much memory.
Statement
A flaw was found in the qs npm package. When an application calls qs.parse() with both comma:true and throwOnLimitExceeded:true enabled (both non-default options), a comma-separated value under a bracket-push key (for example, a[]=1,2,3,4) can bypass the configured arrayLimit and allocate an oversized array, causing denial of service in that application process. This is an incomplete fix for a related issue addressed in qs 6.14.2 (CVE-2026-2391). Red Hat products that bundle qs in the affected version range may be impacted if they parse untrusted query strings or urlencoded request bodies with both options enabled. The availability impact is limited to the application process using qs; host operating systems are not at risk of availability degradation due to this flaw.
Mitigation
Until an updated qs dependency is available in your Red Hat product, limit exposure as follows:
1. If your application calls qs.parse() directly, avoid enabling both comma:true and throwOnLimitExceeded:true when parsing untrusted query strings or urlencoded request bodies. Disable one of these non-default options, or upgrade qs to version 6.16.0 or later.
2. Where qs is included only as a transitive dependency, apply product updates that ship qs 6.16.0 or later when they become available.
3. Enforce HTTP request-line and request-body size limits at your ingress or application server. Because allocated memory scales with attacker-supplied input size, transport-layer limits bound worst-case impact.
Host operating systems are not directly affected. These steps apply to application processes that use qs with the vulnerable configuration.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.7 | N/A | 3.7 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
