Search: CVE-2026-82562

CVE-2026-82562 is a vulnerability in the ljharb qs library versions 6.14.2 through 6.15.3 where the array size limit enforcement for comma-separated values does not apply to parameters using the bracket-push key form (e.g., a[]=1,2,3,4). This allows an attacker to bypass the configured array size limit and cause the parser to allocate large arrays proportional to the input size. The issue is fixed in version 6.16.0.