CVE-2025-15284: 
JavaScript vulnerability analysis and mitigation

CVE-2025-15284 is an Improper Input Validation vulnerability in the qs npm library (query string parsing module) that allows HTTP-based Denial of Service (DoS). The flaw affects all versions of qs prior to 6.14.1 for Node.js. It was disclosed on December 29, 2025, via a GitHub Security Advisory. The CNA-assigned CVSS v3.1 score is 3.7 (Low), while the CVSS v4.0 score is 6.3 (Medium) (Github Advisory, GitHub Advisory DB).

The root cause is a consistency bug (CWE-20: Improper Input Validation) in lib/parse.js of the qs library. The arrayLimit option, intended to cap the size of parsed arrays, was only enforced for indexed notation (a[0]=1&a[1]=2) but not for bracket notation (a[]=1&a[]=2). Specifically, the bracket notation handler at line 159 calls utils.combine([], leaf) without checking options.arrayLimit, while the indexed notation path at line 175 correctly checks index <= options.arrayLimit. An attacker can exploit this by sending HTTP requests with large numbers of bracket-notation parameters to bypass the configured arrayLimit, causing the server to allocate unbounded arrays. Notably, the default parameterLimit of 1000 provides practical mitigation under default configurations, as each a[]=value consumes one parameter slot — the risk is elevated only when parameterLimit is explicitly set to a very high value (Github Advisory, GitHub Commit).

Successful exploitation can cause excessive memory or CPU consumption in any Node.js application that uses qs.parse() with user-controlled input and a custom arrayLimit configuration, potentially leading to application crashes or service degradation. There is no confidentiality or integrity impact — the vulnerability is limited to availability. The practical DoS risk is low under default settings but increases significantly when applications explicitly raise parameterLimit beyond the default of 1000 (Github Advisory, GitHub Advisory DB).

A proof-of-concept is publicly available in the GitHub Security Advisory itself, demonstrating the arrayLimit bypass with a simple Node.js script. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.15%, indicating a low probability of near-term exploitation. No threat actor attribution has been reported (Github Advisory, GitHub Advisory DB).

1. Identify a vulnerable target: Find a Node.js application that uses qs < 6.14.1 with a custom arrayLimit and/or an elevated parameterLimit (above the default of 1000). Applications exposing HTTP endpoints that parse query strings are candidates.
2. Craft a malicious query string: Construct an HTTP request using bracket notation with a large number of repeated parameters exceeding the configured arrayLimit, e.g., GET /api/endpoint?filters[]=x&filters[]=x&... repeated thousands of times.
3. Send the request: Deliver the crafted request to the target endpoint. The qs.parse() function will process all bracket-notation parameters without enforcing arrayLimit, allocating a large array in memory.
4. Trigger resource exhaustion: Repeat the request rapidly or with extremely large payloads to exhaust server memory or CPU, causing degraded performance or a crash (Github Advisory).

• Network: High volumes of HTTP requests to API endpoints with query strings containing large numbers of param[]=value bracket-notation parameters; unusually large query string lengths in HTTP access logs.
• Logs: Application or web server logs showing repeated requests with query strings containing hundreds or thousands of []= parameters; Node.js process crash logs or out-of-memory errors correlated with specific endpoint access.
• Process: Node.js process exhibiting abnormally high memory consumption or CPU spikes coinciding with inbound HTTP traffic; process restarts or OOM-killer events on the host.

The primary remediation is to upgrade the qs npm package to version 6.14.1 or later, which enforces arrayLimit uniformly across both indexed and bracket notations (Github Advisory, GitHub Commit). As a workaround, ensure parameterLimit is kept at the default value of 1000 (do not raise it unnecessarily), which effectively caps the number of bracket-notation array elements. Additionally, implement rate limiting and request size restrictions at the application or network/WAF layer to reduce DoS exposure. Downstream vendors including IBM (multiple products), Splunk (DB Connect), and Oracle (April 2026 CPU) have released or are releasing patches incorporating the fixed qs version (Splunk Advisory, Oracle CPU).

The vulnerability was reported by security researcher samipmainali and remediated by library maintainer ljharb, who also revised the severity downward after noting that the default parameterLimit of 1000 substantially mitigates the originally described DoS scenario (Github Advisory). Multiple enterprise vendors — including IBM, Splunk, and Oracle — issued downstream security bulletins acknowledging the dependency on the vulnerable qs version. The vulnerability received routine coverage in vulnerability tracking feeds and security news aggregators, with no significant controversy or elevated community concern given its low-to-medium severity rating.