CVE-2026-2391 is a vulnerability in the qs JavaScript library version 6.7.0 related to improper input validation (CWE-20). The issue occurs when the qs parser is configured with the comma option set to true, which allows parsing comma-separated strings into arrays. The arrayLimit option is intended to restrict the maximum number of elements in parsed arrays to prevent resource exhaustion. However, the limit enforcement happens after the comma-splitting logic in the parseArrayValue function. Specifically, when a string containing commas is split into an array, the function returns immediately without checking if the resulting array exceeds the configured arrayLimit. This bypasses the limit check, allowing attackers to craft a single query parameter with millions of commas, resulting in the allocation of very large arrays in memory. The downstream merging logic does not prevent this excessive allocation, leading to potential denial-of-service via memory exhaustion. This vulnerability is similar to a previously fixed issue (CVE-2025-15284) involving bracket notation bypasses but affects the comma parsing feature instead. The vulnerability does not require authentication or user interaction and can be triggered remotely by sending maliciously crafted HTTP requests. The default configuration of qs does not enable the comma option, so only applications explicitly enabling it are vulnerable. No official patch was linked at the time of disclosure, but the issue is expected to be fixed in future releases. The CVSS 4.0 base score is 6.3 (medium), reflecting network attack vector, low complexity, no privileges or user interaction required, and limited impact on availability via memory exhaustion.

The primary impact of CVE-2026-2391 is denial-of-service (DoS) through memory exhaustion. Attackers can send specially crafted HTTP requests with query parameters containing extremely long comma-separated lists, causing the qs parser to allocate large arrays in memory. This can lead to application crashes, degraded performance, or complete service outages. Organizations running web applications or APIs that use the vulnerable qs version with comma parsing enabled are at risk. The vulnerability can be exploited remotely without authentication or user interaction, increasing its risk profile. While it does not directly compromise confidentiality or integrity, the availability impact can disrupt business operations, especially for high-traffic or resource-constrained environments. This may affect cloud services, SaaS platforms, and internal applications relying on qs for query string parsing. The lack of enforcement of array limits also increases the risk of resource exhaustion attacks at scale, potentially amplifying the impact in distributed denial-of-service (DDoS) scenarios. No known exploits in the wild have been reported yet, but the vulnerability is straightforward to trigger, making it a credible threat.

1. Upgrade the qs library to a version where this vulnerability is patched once available. Monitor official qs repository and security advisories for updates addressing CVE-2026-2391. 2. If upgrading is not immediately possible, disable the comma option in qs configuration to prevent parsing comma-separated values as arrays. 3. Implement custom input validation and sanitization on query parameters before passing them to qs, limiting the length and format of inputs to prevent excessive commas or large arrays. 4. Employ web application firewalls (WAFs) or API gateways to detect and block suspicious query parameters with abnormally large numbers of commas or excessively long values. 5. Monitor application logs and memory usage for signs of abnormal resource consumption that could indicate exploitation attempts. 6. Consider rate limiting or throttling requests with large query strings to reduce the risk of DoS. 7. Review and test application error handling to ensure graceful degradation in case of parsing failures. 8. Educate development teams about secure configuration of third-party libraries and the risks of enabling non-default options without proper validation.