{
  "cveId": "CVE-2026-2391",
  "url": "https://patchblox.com/security/cve/CVE-2026-2391",
  "summary": "CVE-2026-2391 is fixed in node-qs on 1 platform by DEBIAN-CVE-2026-2391 (version 6.15.0\u002Bds\u002B~6.15.0-1), released February 12, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "node-qs: ### Summary The \u0060arrayLimit\u0060 option in qs does not enforce limits for comma-separated values when \u0060comma: true\u0060 is en...",
  "description": "### Summary The \u0060arrayLimit\u0060 option in qs does not enforce limits for comma-separated values when \u0060comma: true\u0060 is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).  ### Details When the \u0060comma\u0060 option is set to \u0060true\u0060 (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., \u0060?param=a,b,c\u0060 becomes \u0060[\u0027a\u0027, \u0027b\u0027, \u0027c\u0027]\u0060). However, the limit check for \u0060arrayLimit\u0060 (default: 20) and the optional throwOnLimitExceeded occur after the comma-handling logic in \u0060parseArrayValue\u0060, enabling a bypass. This permits creation of arbitrarily large arrays from a single parameter, leading to excessive memory allocation.  **Vulnerable code** (lib/parse.js: lines ~40-50): \u0060\u0060\u0060js if (val \u0026\u0026 typeof val === \u0027string\u0027 \u0026\u0026 options.comma \u0026\u0026 val.indexOf(\u0027,\u0027) \u003E -1) { \u00A0 \u00A0 return val.split(\u0027,\u0027); }  if (options.throwOnLimitExceeded \u0026\u0026 currentArrayLength \u003E= options.arrayLimit) { \u00A0 \u00A0 throw new RangeError(\u0027Array limit exceeded. Only \u0027 \u002B options.arrayLimit \u002B \u0027 element\u0027 \u002B (options.arrayLimit === 1 ? \u0027\u0027 : \u0027s\u0027) \u002B \u0027 allowed in an array.\u0027); }  return val; \u0060\u0060\u0060 The \u0060split(\u0027,\u0027)\u0060 returns the array immediately, skipping the subsequent limit check. Downstream merging via \u0060utils.combine\u0060 does not prevent allocation, even if it marks overflows for sparse arrays.This discrepancy allows attackers to send a single parameter with millions of commas (e.g., \u0060?param=,,,,,,,,...\u0060), allocating massive arrays in memory without triggering limits. It bypasses the intent of \u0060arrayLimit\u0060, which is enforced correctly for indexed (\u0060a[0]=\u0060) and bracket (\u0060a[]=\u0060) notations (the latter fixed in v6.14.1 per GHSA-6rw7-vpxm-498p).  ### PoC **Test 1 - Basic bypass:** \u0060\u0060\u0060 npm install qs \u0060\u0060\u0060  \u0060\u0060\u0060js const qs = require(\u0027qs\u0027);  const payload = \u0027a=\u0027 \u002B \u0027,\u0027.repeat(25);  // 26 elements after split (bypasses arrayLimit: 5) const options = { comma: true, arrayLimit: 5, throwOnLimitExceeded: true };  try { \u00A0 const result = qs.parse(payload, options); \u00A0 console.log(result.a.length);  // Outputs: 26 (bypass successful) } catch (e) { \u00A0 console.log(\u0027Limit enforced:\u0027, e.message);  // Not thrown } \u0060\u0060\u0060 **Configuration:** - \u0060comma: true\u0060 - \u0060arrayLimit: 5\u0060 - \u0060throwOnLimitExceeded: true\u0060  Expected: Throws \u0022Array limit exceeded\u0022 error. Actual: Parses successfully, creating an array of length 26.   ### Impact Denial of Service (DoS) via memory exhaustion.",
  "published": "2026-02-12T05:17:11Z",
  "severity": "high",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00542,
  "epssPercentile": 0.45802,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "node-qs",
      "release": "Debian 14",
      "fixedVersion": "6.15.0\u002Bds\u002B~6.15.0-1",
      "fix": "DEBIAN-CVE-2026-2391",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-2391",
      "released": "2026-02-12T05:17:11Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}