SB2026090291 - Multiple vulnerabilities in qs

Description

This security bulletin contains information about 2 vulnerabilities.

1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-82562)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the qs parser when processing bracket-key comma-separated query string or form body input with comma: true. A remote attacker can supply a specially crafted parameter to cause a denial of service.

A single parameter can materialize an arbitrarily large array, and the issue occurs because bracket-key input can bypass configured arrayLimit and throwOnLimitExceeded checks.

2) Uncaught Exception (CVE-ID: CVE-2026-82417)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an uncaught exception in utils.isBuffer in qs.stringify when processing parsed query string data during a parse-to-stringify round-trip. A remote attacker can send a specially crafted query string to cause a denial of service.

The issue is reachable when qs.parse preserves constructor and isBuffer as own properties, such as with plainObjects: true or allowPrototypes: true.

Remediation

Install update from vendor's website.

References

• https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx
• https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g