CVE-2026-82562: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-82562 is an arrayLimit bypass vulnerability in the qs npm package that allows denial of service via excessive memory allocation when parsing bracket-key comma-separated query strings. When qs.parse is called with both comma: true and throwOnLimitExceeded: true, a comma-separated value under a bracket-push key (e.g., a[]=1,2,3,4) bypasses the configured arrayLimit check, allowing arbitrarily large arrays to be allocated in memory. The vulnerability affects qs versions >= 6.14.2 and <= 6.15.3 (npm package by ljharb), and was published on August 29–30, 2026. It carries a CVSS v3.1 base score of 3.7 (Low) (GitHub Advisory GHSA-x5fp-wj9c-mxmx, Feedly).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling) in lib/parse.js. The parseArrayValue() function enforced the pre-split comma count only for flat array values (controlled by an isFlatArrayValue flag); when a []= bracket-push key was used, the flag was set to false, causing the comma-separated value to be split and wrapped as a single nested element without ever being compared against arrayLimit. This meant the inner array's length was never validated, while equivalent flat (a=), indexed (a[0]=), nested (a[b]=), and dotted (a.b=) key forms all correctly threw a RangeError. The fix (commit 8859c37) removes the isFlatArrayValue gate entirely, so every comma-split value — regardless of key form — is counted before splitting (GitHub Advisory GHSA-x5fp-wj9c-mxmx, Fix Commit).

Successful exploitation causes denial of service through excessive memory allocation on the server parsing the query string. An unauthenticated remote attacker can send a single crafted HTTP request with a parameter like a[]=1, repeated millions of times, forcing the Node.js process to allocate arbitrarily large arrays and potentially exhausting available memory. There is no confidentiality or integrity impact; the vulnerability is limited to availability of the affected service (GitHub Advisory GHSA-x5fp-wj9c-mxmx).

A proof-of-concept is publicly available in the GitHub security advisory, demonstrating that qs.parse('a[]=1,2,3,4', { comma: true, arrayLimit: 3, throwOnLimitExceeded: true }) silently creates an oversized inner array instead of throwing a RangeError. Exploitation requires the target application to have configured qs with comma: true (non-default), which narrows the attack surface. No in-the-wild exploitation, threat actor attribution, CISA KEV listing, or EPSS score data are currently available for this CVE (GitHub Advisory GHSA-x5fp-wj9c-mxmx).

1. Reconnaissance: Identify applications using the qs npm package versions 6.14.2–6.15.3 that accept query strings or form bodies and have configured qs with comma: true (e.g., Express.js apps with custom query parser settings).
2. Craft malicious payload: Construct a query string using the bracket-push key form with a large comma-separated value, such as a[]= followed by 1, repeated 1,000,000 times (e.g., a[]=1,1,1,...,1).
3. Send HTTP request: Submit the crafted query string or form body to any endpoint that parses it with the vulnerable qs configuration, e.g., GET /endpoint?a[]=1,1,1,...,1 or via a POST body.
4. Trigger memory exhaustion: The server's qs.parse call splits the comma-separated value into a 1,000,001-element array without enforcing arrayLimit, causing excessive heap allocation and potentially crashing or severely degrading the Node.js process (GitHub Advisory GHSA-x5fp-wj9c-mxmx, Fix Commit).

• Network: Unusually large HTTP GET or POST requests containing query parameters matching the pattern a[]=<value>,<value>,... with thousands or millions of comma-separated elements; requests significantly exceeding normal query string length limits.
• Logs: Application or web server access logs showing requests with extremely long a[]=... query parameters; Node.js process crash logs or out-of-memory (OOM) errors correlated with specific request patterns.
• Process: Node.js process exhibiting sudden spikes in heap memory usage followed by garbage collection pressure or process termination; elevated CPU usage during query string parsing of large inputs.

Upgrade the qs npm package to version 6.16.0 or later, which contains the fix (commit 8859c37) that removes the isFlatArrayValue gate and enforces arrayLimit uniformly across all key forms including []= bracket-push keys. As a workaround, avoid enabling comma: true in qs options unless strictly necessary, or add application-level request size limits (e.g., via express's limit option or a reverse proxy) to restrict excessively large query strings before they reach the parser (GitHub Advisory GHSA-x5fp-wj9c-mxmx, Fix Commit).

The vulnerability was reported by community researchers Vectrain51 and Fcmam5, with ljharb (the package maintainer) acting as remediation developer and publishing the advisory on August 29, 2026. The advisory notes this is the third in a series of related arrayLimit bypass issues in qs, following CVE-2026-2391 (GHSA-w7fw-mjwx-w883) and an earlier bracket notation bypass (GHSA-6rw7-vpxm-498p / CVE-2025-15284), indicating an ongoing pattern of incremental security hardening in the library (GitHub Advisory GHSA-x5fp-wj9c-mxmx, GitHub Advisory GHSA-w7fw-mjwx-w883).