CVE-2026-2391: 
JavaScript vulnerability analysis and mitigation

CVE-2026-2391 is an arrayLimit bypass vulnerability in the qs npm package that allows denial-of-service via memory exhaustion when the comma: true option is enabled. It affects qs versions >= 6.7.0 and <= 6.14.1 for Node.js. The vulnerability was disclosed and published on February 12, 2026, with a patch released in version 6.14.2. The GitHub Advisory Database rates it Low severity with a CVSS v3.1 score of 3.7 (AV:N/AC:H/PR:N/UI:N), while Feedly's estimate assigns a CVSS v3.1 score of 7.5 (High) based on a lower attack complexity assessment (GitHub Advisory, qs Security Advisory).

The root cause is improper input validation (CWE-20) in lib/parse.js of the qs library. When comma: true is configured, the parseArrayValue function calls val.split(',') and immediately returns the resulting array before the arrayLimit check (default: 20) or throwOnLimitExceeded guard is evaluated — meaning those safety controls are entirely bypassed for comma-parsed values. An attacker can craft a single query parameter containing millions of commas (e.g., ?param=,,,,,,,,...), causing the server to allocate a massive array in memory with no limit enforcement. This is analogous to the bracket notation bypass fixed in GHSA-6rw7-vpxm-498p (CVE-2025-15284), which addressed the same class of issue for a[]= notation in v6.14.1. A public proof-of-concept is included in the advisory itself (GitHub Advisory, Fix Commit).

Successful exploitation results in a Denial of Service (DoS) condition through server-side memory exhaustion. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Applications that use qs with comma: true and expose query string parsing to untrusted network input are at risk of becoming unresponsive or crashing due to excessive memory allocation triggered by a single malformed request (GitHub Advisory, qs Security Advisory).

A proof-of-concept is publicly available within the official security advisory itself, demonstrating that a simple Node.js script using qs.parse() with comma: true can bypass the arrayLimit and throwOnLimitExceeded controls (qs Security Advisory). There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.049% (16th percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Identify target: Locate a Node.js web application that uses the qs library (versions 6.7.0–6.14.1) with the comma: true option enabled in its query string parsing configuration.
2. Craft malicious payload: Construct an HTTP request with a query parameter containing a very large number of commas, e.g., GET /?param= followed by millions of comma characters (,,,,,...).
3. Send the request: Deliver the crafted request to any endpoint of the target application that parses query strings using qs with comma: true. No authentication is required.
4. Trigger memory exhaustion: The qs parser calls val.split(',') on the parameter value, creating an array with millions of elements before any limit check occurs, causing the server process to allocate excessive memory.
5. Achieve DoS: The server's memory is exhausted, causing the Node.js process to slow significantly, become unresponsive, or crash, resulting in denial of service for legitimate users (GitHub Advisory).

• Network: Unusually large HTTP GET or POST requests with query parameters containing long strings of comma characters (e.g., param=%2C%2C%2C... or param=,,,,...); high-volume requests to query-string-parsing endpoints from a single source IP.
• Logs: Web server or application logs showing requests with abnormally long query string values for a single parameter; Node.js process crash logs or out-of-memory (OOM) errors in application logs coinciding with such requests.
• Process: Sudden spike in Node.js process memory consumption; process restarts or OOM-killer events in system logs (e.g., /var/log/syslog or dmesg) attributed to the Node.js application process.

The primary remediation is to upgrade the qs npm package to version 6.14.2 or later, which enforces arrayLimit on comma-parsed values by checking the split array length before returning it (Fix Commit, GitHub Advisory). As a temporary workaround, disable the comma: true option in qs configuration if it is not required by the application. Organizations running affected IBM products (including IBM API Connect, IBM Maximo Application Suite, IBM Cloud Pak for Automation, IBM watsonx Orchestrate, IBM Guardium Data Security Center, and others) should apply the relevant IBM security bulletins (IBM Advisory).

The vulnerability was reported by security researcher SharokhAtaie and coordinated by ljharb (the qs maintainer), who published the advisory and fix on February 12, 2026 (qs Security Advisory). IBM issued multiple security bulletins across its product portfolio acknowledging the impact of CVE-2026-2391 on products including IBM API Connect, IBM Maximo Application Suite, IBM Cloud Pak for Automation, and others (IBM Advisory). A community technical write-up titled "Death by a Thousand Commas" was published on dev.to, and the vulnerability received coverage in weekly threat landscape digests, reflecting moderate community interest given its DoS-only impact and non-default configuration requirement.