CVE-2026-82562: CWE-770 Allocation of Resources Without Limits or Throttling in ljharb qs
Description
CVE-2026-82562 is a resource allocation vulnerability in the ljharb qs library versions 6.14.2 through before 6.16.0. When parsing query strings with options comma: true and throwOnLimitExceeded: true, a specially crafted parameter using the bracket-push key form (e.g., a[]=1,2,3,4) bypasses the configured array size limit, causing the parser to allocate an arbitrarily large inner array. This occurs because the limit check does not apply correctly to bracket-push keys, allowing linear resource exhaustion proportional to input size. The issue was fixed in version 6.16.0 by correcting the limit enforcement logic.
CVSS v3.1
Score 3.7low
Affected software
ljharb
qs
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises in the qs library's parse function when called with comma: true and throwOnLimitExceeded: true. For parameters using the bracket-push key form (a[]=...), comma-separated values are split into an inner array without enforcing the arrayLimit, unlike other key forms which correctly throw a RangeError if the limit is exceeded. This allows an attacker to bypass the hard limit on array size by supplying a single parameter with a very large comma-separated list, causing the parser to allocate a large array proportional to the input size. The flaw persisted in versions >=6.14.2 and <6.16.0. The fix in v6.16.0 removed the gating condition that excluded bracket-push keys from the limit check, ensuring all comma-split values are counted against arrayLimit before splitting.
Potential Impact
An unauthenticated attacker able to send crafted query strings or URL-encoded bodies to an application using qs with comma: true and throwOnLimitExceeded: true can bypass the configured array size limit for bracket-push keys. This leads to allocation of large arrays proportional to the input size, potentially causing increased memory usage and performance degradation. However, the impact is limited by transport-layer request size limits and Node.js default HTTP header size limits, bounding the maximum resource consumption. The vulnerability does not allow arbitrary code execution or data exposure, only denial of service via resource exhaustion at a linear cost relative to input size.
Mitigation Recommendations
A fix is available in qs version 6.16.0 that corrects the arrayLimit enforcement for comma-separated values under bracket-push keys. Users should upgrade to version 6.16.0 or later. If upgrading is not immediately possible, carefully review usage of comma: true and throwOnLimitExceeded: true options and consider disabling them or applying input size limits at the transport layer to mitigate resource exhaustion. Patch status is confirmed by the vendor's release notes for v6.16.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- harborist
- Date Reserved
- 2026-08-29T23:51:36.085Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a940de9acd9273b4972699a
Added to database: 08/30/2026, 11:03:05 UTC
Last enriched: 09/07/2026, 15:35:40 UTC
Last updated: 10/14/2026, 18:48:24 UTC
Views: 108
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.