{"id":"CVE-2025-15284","revision":"7775ef813114433ebaa376aa144a8a9b","records":[{"revision":"7775ef813114433ebaa376aa144a8a9b","observedAt":"2026-10-25T01:17:29.167+00:00","statement":{"source":"nvd","id":"CVE-2025-15284","aliases":[],"title":"Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.","description":"Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.\n\n\nSummary\n\nThe arrayLimit\u00A0option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit\u00A0should apply uniformly across all array notations.\n\nNote:\u00A0The default parameterLimit\u00A0of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit\u00A0regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.\n\nDetails\n\nThe arrayLimit\u00A0option only checked limits for indexed notation (a[0]=1&a[1]=2) but did not enforce it for bracket notation (a[]=1&a[]=2).\n\nVulnerable code\u00A0(lib/parse.js:159-162):\n\nif (root === '[]' && options.parseArrays) {\n    obj = utils.combine([], leaf);  // No arrayLimit check\n}\n\n\n\n\n\nWorking code\u00A0(lib/parse.js:175):\n\nelse if (index <= options.arrayLimit) {  // Limit checked here\n    obj = [];\n    obj[index] = leaf;\n}\n\n\n\n\n\nThe bracket notation handler at line 159 uses utils.combine([], leaf)\u00A0without validating against options.arrayLimit, while indexed notation at line 175 checks index <= options.arrayLimit\u00A0before creating arrays.\n\n\n\nPoC\n\nconst qs = require('qs');\nconst result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5 });\nconsole.log(result.a.length);  // Output: 6 (should be max 5)\n\n\n\n\n\nNote on parameterLimit interaction:\u00A0The original advisory's \"DoS demonstration\" claimed a length of 10,000, but parameterLimit\u00A0(default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.\n\nImpact\n\nConsistency bug in arrayLimit\u00A0enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit\u00A0already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit\u00A0is explicitly set to a very high value.","state":0,"publishedAt":"2025-12-29T23:15:42.703+00:00","modifiedAt":"2026-10-14T19:10:00.297+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · 7ffcee3d-2c14-4c3e-b844-86c6a321a158 · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":6.3,"severity":"MEDIUM"},{"system":"CVSS 3.1 · 7ffcee3d-2c14-4c3e-b844-86c6a321a158 · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","score":3.7,"severity":"LOW"}],"references":["https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9","https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-15284","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-20"],"productCriteria":["cpe:2.3:a:qs_project:qs:*:*:*:*:*:node.js:*:*"],"sourceDates":{"published":"2025-12-29T23:15:42.703","lastModified":"2026-10-14T19:10:00.297"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2025-15284","identifiers":["CVE-2025-15284"]},"retained":false,"historicalAffected":[]}],"coverage":[]}