{ "cveId": "CVE-2025-15284", "url": "https://patchblox.com/security/cve/CVE-2025-15284", "summary": "CVE-2025-15284 is fixed in 9 products on 1 platform, first by DEBIAN-CVE-2025-15284, released December 29, 2025. It is not reported as exploited. Patch Radar priority: High.", "title": "node-qs: Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: \u003C 6.14.1", "description": "Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: \u003C 6.14.1. Summary The arrayLimit\u00A0option in qs did not enforce limits for bracket notation (a[]=1\u0026a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit\u00A0should apply uniformly across all array notations. Note:\u00A0The default parameterLimit\u00A0of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit\u00A0regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly. Details The arrayLimit\u00A0option only checked limits for indexed notation (a[0]=1\u0026a[1]=2) but did not enforce it for bracket notation (a[]=1\u0026a[]=2). Vulnerable code\u00A0(lib/parse.js:159-162): if (root === \u0027[]\u0027 \u0026\u0026 options.parseArrays) { obj = utils.combine([], leaf); // No arrayLimit check } Working code\u00A0(lib/parse.js:175): else if (index \u003C= options.arrayLimit) { // Limit checked here obj = []; obj[index] = leaf; } The bracket notation handler at line 159 uses utils.combine([], leaf)\u00A0without validating against options.arrayLimit, while indexed notation at line 175 checks index \u003C= options.arrayLimit\u00A0before creating arrays. PoC const qs = require(\u0027qs\u0027); const result = qs.parse(\u0027a[]=1\u0026a[]=2\u0026a[]=3\u0026a[]=4\u0026a[]=5\u0026a[]=6\u0027, { arrayLimit: 5 }); console.log(result.a.length); // Output: 6 (should be max 5) Note on parameterLimit interaction:\u00A0The original advisory\u0027s \u0022DoS demonstration\u0022 claimed a length of 10,000, but parameterLimit\u00A0(default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000. Impact Consistency bug in arrayLimit\u00A0enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit\u00A0already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit\u00A0is explicitly set to a very high value.", "published": "2025-12-29T22:56:45Z", "severity": "important", "cvss": 8.8, "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L", "epss": 0.0045, "epssPercentile": 0.39326, "priority": "High", "priorityTier": 3, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "linux-sgx", "release": "RHEL 10", "fixedVersion": "2.26-7.el10", "fix": "RHSA-2026:18480", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-18480", "released": "2026-01-28T00:20:13Z" }, { "platform": "linux", "product": "linux-sgx", "release": "rocky 10", "fixedVersion": "0:2.26-7.el10", "fix": "RLSA-2026:18480", "url": "https://patchblox.com/security/fix/linux/rlsa-2026-18480", "released": "2026-05-29T16:03:45Z" }, { "platform": "linux", "product": "linux-sgx", "release": "rocky 9", "fixedVersion": "0:2.26-7.el9", "fix": "RLSA-2026:18868", "url": "https://patchblox.com/security/fix/linux/rlsa-2026-18868", "released": "2026-05-28T15:43:06Z" }, { "platform": "linux", "product": "node-qs", "release": "Debian 14", "fixedVersion": "6.14.1\u002Bds\u002B~6.14.0-1", "fix": "DEBIAN-CVE-2025-15284", "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-15284", "released": "2025-12-29T23:15:42Z" }, { "platform": "linux", "product": "sgx-common", "release": "RHEL 9", "fixedVersion": "0:2.26-7.el9", "fix": "RHSA-2026:18868", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-18868", "released": "2026-05-27T17:40:12Z" }, { "platform": "linux", "product": "sgx-common", "release": "almalinux 10", "fixedVersion": "2.26-7.el10", "fix": "ALSA-2026:18480", "url": "https://patchblox.com/security/fix/linux/alsa-2026-18480", "released": "2026-05-19T00:00:00Z" }, { "platform": "linux", "product": "sgx-common", "release": "almalinux 9", "fixedVersion": "2.26-7.el9", "fix": "ALSA-2026:18868", "url": "https://patchblox.com/security/fix/linux/alsa-2026-18868", "released": "2026-05-19T00:00:00Z" }, { "platform": "linux", "product": "sgx-common", "release": "ol 10", "fixedVersion": "0:2.26-7.el10", "fix": "ELSA-2026-18480", "url": "https://patchblox.com/security/fix/linux/elsa-2026-18480", "released": "2026-07-08T00:00:00Z" }, { "platform": "linux", "product": "sgx-common", "release": "ol 9", "fixedVersion": "0:2.26-7.el9", "fix": "ELSA-2026-18868", "url": "https://patchblox.com/security/fix/linux/elsa-2026-18868", "released": "2026-06-12T00:00:00Z" }, { "platform": "linux", "product": "sgx-libs", "release": "RHEL 9", "fixedVersion": "0:2.26-7.el9", "fix": "RHSA-2026:18868", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-18868", "released": "2026-05-27T17:40:12Z" }, { "platform": "linux", "product": "sgx-libs", "release": "almalinux 10", "fixedVersion": "2.26-7.el10", "fix": "ALSA-2026:18480", "url": "https://patchblox.com/security/fix/linux/alsa-2026-18480", "released": "2026-05-19T00:00:00Z" }, { "platform": "linux", "product": "sgx-libs", "release": "almalinux 9", "fixedVersion": "2.26-7.el9", "fix": "ALSA-2026:18868", "url": "https://patchblox.com/security/fix/linux/alsa-2026-18868", "released": "2026-05-19T00:00:00Z" }, { "platform": "linux", "product": "sgx-libs", "release": "ol 10", "fixedVersion": "0:2.26-7.el10", "fix": "ELSA-2026-18480", "url": "https://patchblox.com/security/fix/linux/elsa-2026-18480", "released": "2026-07-08T00:00:00Z" }, { "platform": "linux", "product": "sgx-libs", "release": "ol 9", "fixedVersion": "0:2.26-7.el9", "fix": "ELSA-2026-18868", "url": "https://patchblox.com/security/fix/linux/elsa-2026-18868", "released": "2026-06-12T00:00:00Z" }, { "platform": "linux", "product": "sgx-mpa", "release": "RHEL 9", "fixedVersion": "0:2.26-7.el9", "fix": "RHSA-2026:18868", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-18868", "released": "2026-05-27T17:40:12Z" }, { "platform": "linux", "product": "sgx-mpa", "release": "almalinux 10", "fixedVersion": "2.26-7.el10", "fix": "ALSA-2026:18480", "url": "https://patchblox.com/security/fix/linux/alsa-2026-18480", "released": "2026-05-19T00:00:00Z" }, { "platform": "linux", "product": "sgx-mpa", "release": "almalinux 9", "fixedVersion": "2.26-7.el9", "fix": "ALSA-2026:18868", "url": "https://patchblox.com/security/fix/linux/alsa-2026-18868", "released": "2026-05-19T00:00:00Z" }, { "platform": "linux", "product": "sgx-mpa", "release": "ol 10", "fixedVersion": "0:2.26-7.el10", "fix": "ELSA-2026-18480", "url": "https://patchblox.com/security/fix/linux/elsa-2026-18480", "released": "2026-07-08T00:00:00Z" }, { "platform": "linux", "product": "sgx-mpa", "release": "ol 9", "fixedVersion": "0:2.26-7.el9", "fix": "ELSA-2026-18868", "url": "https://patchblox.com/security/fix/linux/elsa-2026-18868", "released": "2026-06-12T00:00:00Z" }, { "platform": "linux", "product": "sgx-pccs", "release": "RHEL 9", "fixedVersion": "0:2.26-7.el9", "fix": "RHSA-2026:18868", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-18868", "released": "2026-05-27T17:40:12Z" }, { "platform": "linux", "product": "sgx-pccs", "release": "almalinux 10", "fixedVersion": "2.26-7.el10", "fix": "ALSA-2026:18480", "url": "https://patchblox.com/security/fix/linux/alsa-2026-18480", "released": "2026-05-19T00:00:00Z" }, { "platform": "linux", "product": "sgx-pccs", "release": "almalinux 9", "fixedVersion": "2.26-7.el9", "fix": "ALSA-2026:18868", "url": "https://patchblox.com/security/fix/linux/alsa-2026-18868", "released": "2026-05-19T00:00:00Z" }, { "platform": "linux", "product": "sgx-pccs", "release": "ol 10", "fixedVersion": "0:2.26-7.el10", "fix": "ELSA-2026-18480", "url": "https://patchblox.com/security/fix/linux/elsa-2026-18480", "released": "2026-07-08T00:00:00Z" }, { "platform": "linux", "product": "sgx-pccs", "release": "ol 9", "fixedVersion": "0:2.26-7.el9", "fix": "ELSA-2026-18868", "url": "https://patchblox.com/security/fix/linux/elsa-2026-18868", "released": "2026-06-12T00:00:00Z" }, { "platform": "linux", "product": "sgx-pccs-admin", "release": "RHEL 9", "fixedVersion": "0:2.26-7.el9", "fix": "RHSA-2026:18868", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-18868", "released": "2026-05-27T17:40:12Z" }, { "platform": "linux", "product": "sgx-pccs-admin", "release": "almalinux 10", "fixedVersion": "2.26-7.el10", "fix": "ALSA-2026:18480", "url": "https://patchblox.com/security/fix/linux/alsa-2026-18480", "released": "2026-05-19T00:00:00Z" }, { "platform": "linux", "product": "sgx-pccs-admin", "release": "almalinux 9", "fixedVersion": "2.26-7.el9", "fix": "ALSA-2026:18868", "url": "https://patchblox.com/security/fix/linux/alsa-2026-18868", "released": "2026-05-19T00:00:00Z" }, { "platform": "linux", "product": "sgx-pccs-admin", "release": "ol 10", "fixedVersion": "0:2.26-7.el10", "fix": "ELSA-2026-18480", "url": "https://patchblox.com/security/fix/linux/elsa-2026-18480", "released": "2026-07-08T00:00:00Z" }, { "platform": "linux", "product": "sgx-pccs-admin", "release": "ol 9", "fixedVersion": "0:2.26-7.el9", "fix": "ELSA-2026-18868", "url": "https://patchblox.com/security/fix/linux/elsa-2026-18868", "released": "2026-06-12T00:00:00Z" }, { "platform": "linux", "product": "sgx-pckid-tool", "release": "RHEL 9", "fixedVersion": "0:2.26-7.el9", "fix": "RHSA-2026:18868", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-18868", "released": "2026-05-27T17:40:12Z" }, { "platform": "linux", "product": "sgx-pckid-tool", "release": "almalinux 10", "fixedVersion": "2.26-7.el10", "fix": "ALSA-2026:18480", "url": "https://patchblox.com/security/fix/linux/alsa-2026-18480", "released": "2026-05-19T00:00:00Z" }, { "platform": "linux", "product": "sgx-pckid-tool", "release": "almalinux 9", "fixedVersion": "2.26-7.el9", "fix": "ALSA-2026:18868", "url": "https://patchblox.com/security/fix/linux/alsa-2026-18868", "released": "2026-05-19T00:00:00Z" }, { "platform": "linux", "product": "sgx-pckid-tool", "release": "ol 10", "fixedVersion": "0:2.26-7.el10", "fix": "ELSA-2026-18480", "url": "https://patchblox.com/security/fix/linux/elsa-2026-18480", "released": "2026-07-08T00:00:00Z" }, { "platform": "linux", "product": "sgx-pckid-tool", "release": "ol 9", "fixedVersion": "0:2.26-7.el9", "fix": "ELSA-2026-18868", "url": "https://patchblox.com/security/fix/linux/elsa-2026-18868", "released": "2026-06-12T00:00:00Z" }, { "platform": "linux", "product": "tdx-qgs", "release": "RHEL 9", "fixedVersion": "0:2.26-7.el9", "fix": "RHSA-2026:18868", "url": "https://patchblox.com/security/fix/linux/rhsa-2026-18868", "released": "2026-05-27T17:40:12Z" }, { "platform": "linux", "product": "tdx-qgs", "release": "almalinux 10", "fixedVersion": "2.26-7.el10", "fix": "ALSA-2026:18480", "url": "https://patchblox.com/security/fix/linux/alsa-2026-18480", "released": "2026-05-19T00:00:00Z" }, { "platform": "linux", "product": "tdx-qgs", "release": "almalinux 9", "fixedVersion": "2.26-7.el9", "fix": "ALSA-2026:18868", "url": "https://patchblox.com/security/fix/linux/alsa-2026-18868", "released": "2026-05-19T00:00:00Z" }, { "platform": "linux", "product": "tdx-qgs", "release": "ol 10", "fixedVersion": "0:2.26-7.el10", "fix": "ELSA-2026-18480", "url": "https://patchblox.com/security/fix/linux/elsa-2026-18480", "released": "2026-07-08T00:00:00Z" }, { "platform": "linux", "product": "tdx-qgs", "release": "ol 9", "fixedVersion": "0:2.26-7.el9", "fix": "ELSA-2026-18868", "url": "https://patchblox.com/security/fix/linux/elsa-2026-18868", "released": "2026-06-12T00:00:00Z" } ], "noFixYet": [], "dataAsOf": "2026-11-09T01:18:40Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }