CVE-2026-82562

A flaw was found in qs. An unauthenticated attacker can exploit this by sending a specially crafted query string to an application using qs.parse with specific non-default settings (comma: true and throwOnLimitExceeded: true). This bypasses a configured array limit, causing the parser to allocate an excessively large array. This can lead to a Denial of Service (DoS) by consuming too much memory.

A flaw was found in the qs npm package. When an application calls qs.parse() with both comma:true and throwOnLimitExceeded:true enabled (both non-default options), a comma-separated value under a bracket-push key (for example, a[]=1,2,3,4) can bypass the configured arrayLimit and allocate an oversized array, causing denial of service in that application process. This is an incomplete fix for a related issue addressed in qs 6.14.2 (CVE-2026-2391). Red Hat products that bundle qs in the affected version range may be impacted if they parse untrusted query strings or urlencoded request bodies with both options enabled. The availability impact is limited to the application process using qs; host operating systems are not at risk of availability degradation due to this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Until an updated qs dependency is available in your Red Hat product, limit exposure as follows:

1. If your application calls qs.parse() directly, avoid enabling both comma:true and throwOnLimitExceeded:true when parsing untrusted query strings or urlencoded request bodies. Disable one of these non-default options, or upgrade qs to version 6.16.0 or later.

2. Where qs is included only as a transitive dependency, apply product updates that ship qs 6.16.0 or later when they become available.

3. Enforce HTTP request-line and request-body size limits at your ingress or application server. Because allocated memory scales with attacker-supplied input size, transport-layer limits bound worst-case impact.

Host operating systems are not directly affected. These steps apply to application processes that use qs with the vulnerable configuration.