{"id":"EUVD-2026-6720","revision":"d46da2e91c6845aeadf830d0db25bd5f","records":[{"revision":"d46da2e91c6845aeadf830d0db25bd5f","observedAt":"2026-10-30T02:53:25.403+00:00","statement":{"source":"euvd","id":"EUVD-2026-6720","aliases":["CVE-2026-2391","GHSA-w7fw-mjwx-w883"],"title":"### Summary","description":"### Summary\nThe `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).\n\n### Details\nWhen the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?param=a,b,c` becomes `['a', 'b', 'c']`). However, the limit check for `arrayLimit` (default: 20) and the optional throwOnLimitExceeded occur after the comma-handling logic in `parseArrayValue`, enabling a bypass. This permits creation of arbitrarily large arrays from a single parameter, leading to excessive memory allocation.\n\n**Vulnerable code** (lib/parse.js: lines ~40-50):\n```js\nif (val && typeof val === 'string' && options.comma && val.indexOf(',') > -1) {\n\u00A0 \u00A0 return val.split(',');\n}\n\nif (options.throwOnLimitExceeded && currentArrayLength >= options.arrayLimit) {\n\u00A0 \u00A0 throw new RangeError('Array limit exceeded. Only ' + options.arrayLimit + ' element' + (options.arrayLimit === 1 ? '' : 's') + ' allowed in an array.');\n}\n\nreturn val;\n```\nThe `split(',')` returns the array immediately, skipping the subsequent limit check. Downstream merging via `utils.combine` does not prevent allocation, even if it marks overflows for sparse arrays.This discrepancy allows attackers to send a single parameter with millions of commas (e.g., `?param=,,,,,,,,...`), allocating massive arrays in memory without triggering limits. It bypasses the intent of `arrayLimit`, which is enforced correctly for indexed (`a[0]=`) and bracket (`a[]=`) notations (the latter fixed in v6.14.1 per GHSA-6rw7-vpxm-498p).\n\n### PoC\n**Test 1 - Basic bypass:**\n```\nnpm install qs\n```\n\n```js\nconst qs = require('qs');\n\nconst payload = 'a=' + ','.repeat(25);  // 26 elements after split (bypasses arrayLimit: 5)\nconst options = { comma: true, arrayLimit: 5, throwOnLimitExceeded: true };\n\ntry {\n\u00A0 const result = qs.parse(payload, options);\n\u00A0 console.log(result.a.length);  // Outputs: 26 (bypass successful)\n} catch (e) {\n\u00A0 console.log('Limit enforced:', e.message);  // Not thrown\n}\n```\n**Configuration:**\n- `comma: true`\n- `arrayLimit: 5`\n- `throwOnLimitExceeded: true`\n\nExpected: Throws \"Array limit exceeded\" error.\nActual: Parses successfully, creating an array of length 26.\n\n\n### Impact\nDenial of Service (DoS) via memory exhaustion.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":6.3,"severity":null}],"references":["https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-6720","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Feb 12, 2026, 4:39:42 AM","dateUpdated":"Feb 12, 2026, 5:32:05 PM"},"relatedAdvisories":[{"id":"WID-SEC-W-2026-3623","title":"IBM DataPower Gateway: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2023-53781","CVE-2025-14087","CVE-2025-14512","CVE-2025-21858","CVE-2025-22105","CVE-2025-37980","CVE-2025-38015","CVE-2025-38097","CVE-2025-38180","CVE-2025-38400","CVE-2025-38405","CVE-2025-38441","CVE-2025-38470","CVE-2025-38653","CVE-2025-39766","CVE-2025-39797","CVE-2025-39866","CVE-2025-40134","CVE-2025-48431","CVE-2025-5278","CVE-2025-68183","CVE-2025-68211","CVE-2025-68214","CVE-2025-68347","CVE-2025-68366","CVE-2025-68724","CVE-2025-71066","CVE-2025-71089","CVE-2026-12143","CVE-2026-13257","CVE-2026-13258","CVE-2026-13757","CVE-2026-14269","CVE-2026-14273","CVE-2026-14496","CVE-2026-14497","CVE-2026-14502","CVE-2026-14507","CVE-2026-14508","CVE-2026-14509","CVE-2026-14888","CVE-2026-14905","CVE-2026-14988","CVE-2026-14990","CVE-2026-14991","CVE-2026-14992","CVE-2026-14999","CVE-2026-15588","CVE-2026-15762","CVE-2026-15781","CVE-2026-15784","CVE-2026-15819","CVE-2026-15822","CVE-2026-15824","CVE-2026-16111","CVE-2026-16159","CVE-2026-16161","CVE-2026-16163","CVE-2026-16164","CVE-2026-16165","CVE-2026-16167","CVE-2026-16169","CVE-2026-16170","CVE-2026-16176","CVE-2026-16177","CVE-2026-16178","CVE-2026-16179","CVE-2026-16181","CVE-2026-16182","CVE-2026-16340","CVE-2026-16439","CVE-2026-16440","CVE-2026-16441","CVE-2026-2100","CVE-2026-22979","CVE-2026-22984","CVE-2026-22990","CVE-2026-23002","CVE-2026-23060","CVE-2026-23110","CVE-2026-23204","CVE-2026-23209","CVE-2026-23216","CVE-2026-23243","CVE-2026-23270","CVE-2026-23392","CVE-2026-23455","CVE-2026-2391","CVE-2026-31411","CVE-2026-31419","CVE-2026-31488","CVE-2026-31508","CVE-2026-31532","CVE-2026-31581","CVE-2026-31607","CVE-2026-31613","CVE-2026-31669","CVE-2026-31677","CVE-2026-31684","CVE-2026-31685","CVE-2026-33845","CVE-2026-33846","CVE-2026-3832","CVE-2026-3833","CVE-2026-4046","CVE-2026-41254","CVE-2026-41602","CVE-2026-41606","CVE-2026-41607","CVE-2026-42009","CVE-2026-42010","CVE-2026-42011","CVE-2026-42012","CVE-2026-42013","CVE-2026-42014","CVE-2026-42015","CVE-2026-43027","CVE-2026-43037","CVE-2026-43038","CVE-2026-43056","CVE-2026-43074","CVE-2026-43116","CVE-2026-43125","CVE-2026-43163","CVE-2026-43190","CVE-2026-43198","CVE-2026-43260","CVE-2026-43284","CVE-2026-43303","CVE-2026-43329","CVE-2026-43499","CVE-2026-43501","CVE-2026-43868","CVE-2026-43870","CVE-2026-4437","CVE-2026-4438","CVE-2026-45852","CVE-2026-46054","CVE-2026-46086","CVE-2026-46116","CVE-2026-46173","CVE-2026-46181","CVE-2026-46242","CVE-2026-46259","CVE-2026-46300","CVE-2026-46331","CVE-2026-46333","CVE-2026-46917","CVE-2026-46968","CVE-2026-47010","CVE-2026-47021","CVE-2026-47027","CVE-2026-47059","CVE-2026-47063","CVE-2026-48144","CVE-2026-48145","CVE-2026-5260","CVE-2026-52923","CVE-2026-52991","CVE-2026-53006","CVE-2026-53009","CVE-2026-53131","CVE-2026-53189","CVE-2026-53264","CVE-2026-53266","CVE-2026-5419","CVE-2026-5450","CVE-2026-55602","CVE-2026-55603","CVE-2026-55968","CVE-2026-55970","CVE-2026-58010","CVE-2026-58011","CVE-2026-58012","CVE-2026-58013","CVE-2026-58014","CVE-2026-58015","CVE-2026-58016","CVE-2026-58662","CVE-2026-59879","CVE-2026-59880","CVE-2026-60147","CVE-2026-60589","CVE-2026-61308","CVE-2026-63913","CVE-2026-63952","CVE-2026-64017","CVE-2026-64530","CVE-2026-64560","CVE-2026-70906","CVE-2026-70907","CVE-2026-74581","CVE-2026-82417","CVE-2026-82562","CVE-2026-83605","CVE-2026-83607","CVE-2026-83608","CVE-2026-83613","CVE-2026-83614","CVE-2026-83615","CVE-2026-83616","CVE-2026-83619"]},{"id":"WID-SEC-W-2026-3046","title":"IBM Concert: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2019-19921","CVE-2021-23337","CVE-2024-3651","CVE-2024-39338","CVE-2024-45590","CVE-2025-13465","CVE-2025-15284","CVE-2025-15599","CVE-2025-22874","CVE-2025-47273","CVE-2025-47907","CVE-2025-52881","CVE-2025-53643","CVE-2025-55184","CVE-2025-58056","CVE-2025-58188","CVE-2025-58189","CVE-2025-61723","CVE-2025-61730","CVE-2025-64649","CVE-2025-64756","CVE-2025-67221","CVE-2025-68121","CVE-2025-68146","CVE-2026-0540","CVE-2026-2327","CVE-2026-23490","CVE-2026-23897","CVE-2026-2391","CVE-2026-23949","CVE-2026-24486","CVE-2026-25528","CVE-2026-25547","CVE-2026-25639","CVE-2026-25990","CVE-2026-26007","CVE-2026-26019","CVE-2026-26996","CVE-2026-27142","CVE-2026-27212","CVE-2026-27699","CVE-2026-27903","CVE-2026-27904","CVE-2026-28684","CVE-2026-29063","CVE-2026-29181","CVE-2026-2950","CVE-2026-31808","CVE-2026-31900","CVE-2026-32274","CVE-2026-32288","CVE-2026-32597","CVE-2026-32630","CVE-2026-32887","CVE-2026-32952","CVE-2026-33186","CVE-2026-33532","CVE-2026-33750","CVE-2026-33814","CVE-2026-33816","CVE-2026-33916","CVE-2026-34043","CVE-2026-34073","CVE-2026-34077","CVE-2026-3520","CVE-2026-35469","CVE-2026-35515","CVE-2026-3627","CVE-2026-39823","CVE-2026-39825","CVE-2026-39826","CVE-2026-39892","CVE-2026-39984","CVE-2026-40175","CVE-2026-40179","CVE-2026-40181","CVE-2026-40190","CVE-2026-40347","CVE-2026-41066","CVE-2026-41182","CVE-2026-41238","CVE-2026-41239","CVE-2026-41240","CVE-2026-41305","CVE-2026-41324","CVE-2026-41425","CVE-2026-41481","CVE-2026-41488","CVE-2026-41602","CVE-2026-41636","CVE-2026-42151","CVE-2026-42154","CVE-2026-42198","CVE-2026-42211","CVE-2026-42338","CVE-2026-42342","CVE-2026-42561","CVE-2026-42577","CVE-2026-43870","CVE-2026-44405","CVE-2026-44431","CVE-2026-44432","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44496","CVE-2026-44728","CVE-2026-4539","CVE-2026-45409","CVE-2026-45736","CVE-2026-46625","CVE-2026-4800","CVE-2026-4923","CVE-2026-4926","CVE-2026-7246","CVE-2026-8723"]},{"id":"NCSC-2026-0431","title":"Kwetsbaarheden verholpen in IBM DataPower Gateway en onderliggende componenten","vulnerabilityIds":["CVE-2023-53781","CVE-2025-14087","CVE-2025-14512","CVE-2025-21858","CVE-2025-22105","CVE-2025-37980","CVE-2025-38015","CVE-2025-38097","CVE-2025-38180","CVE-2025-38400","CVE-2025-38405","CVE-2025-38441","CVE-2025-38470","CVE-2025-38653","CVE-2025-39766","CVE-2025-39797","CVE-2025-39866","CVE-2025-40134","CVE-2025-48431","CVE-2025-5278","CVE-2025-68183","CVE-2025-68211","CVE-2025-68214","CVE-2025-68347","CVE-2025-68366","CVE-2025-68724","CVE-2025-71066","CVE-2025-71089","CVE-2026-12143","CVE-2026-13257","CVE-2026-13258","CVE-2026-13757","CVE-2026-14269","CVE-2026-14273","CVE-2026-14496","CVE-2026-14497","CVE-2026-14502","CVE-2026-14507","CVE-2026-14508","CVE-2026-14509","CVE-2026-14888","CVE-2026-14905","CVE-2026-14988","CVE-2026-14990","CVE-2026-14991","CVE-2026-14992","CVE-2026-14999","CVE-2026-15588","CVE-2026-15762","CVE-2026-15781","CVE-2026-15784","CVE-2026-15819","CVE-2026-15822","CVE-2026-15824","CVE-2026-16111","CVE-2026-16159","CVE-2026-16161","CVE-2026-16163","CVE-2026-16164","CVE-2026-16165","CVE-2026-16167","CVE-2026-16169","CVE-2026-16170","CVE-2026-16176","CVE-2026-16177","CVE-2026-16178","CVE-2026-16179","CVE-2026-16181","CVE-2026-16182","CVE-2026-16340","CVE-2026-16439","CVE-2026-16440","CVE-2026-16441","CVE-2026-2100","CVE-2026-22979","CVE-2026-22984","CVE-2026-22990","CVE-2026-23002","CVE-2026-23060","CVE-2026-23110","CVE-2026-23204","CVE-2026-23209","CVE-2026-23216","CVE-2026-23243","CVE-2026-23270","CVE-2026-23392","CVE-2026-23455","CVE-2026-2391","CVE-2026-31411","CVE-2026-31419","CVE-2026-31488","CVE-2026-31508","CVE-2026-31532","CVE-2026-31581","CVE-2026-31607","CVE-2026-31613","CVE-2026-31669","CVE-2026-31677","CVE-2026-31684","CVE-2026-31685","CVE-2026-33845","CVE-2026-33846","CVE-2026-3832","CVE-2026-3833","CVE-2026-4046","CVE-2026-41254","CVE-2026-41602","CVE-2026-41606","CVE-2026-41607","CVE-2026-42009","CVE-2026-42010","CVE-2026-42011","CVE-2026-42012","CVE-2026-42013","CVE-2026-42014","CVE-2026-42015","CVE-2026-43027","CVE-2026-43037","CVE-2026-43038","CVE-2026-43056","CVE-2026-43074","CVE-2026-43116","CVE-2026-43125","CVE-2026-43163","CVE-2026-43190","CVE-2026-43198","CVE-2026-43260","CVE-2026-43284","CVE-2026-43303","CVE-2026-43329","CVE-2026-43499","CVE-2026-43501","CVE-2026-43868","CVE-2026-43870","CVE-2026-4437","CVE-2026-4438","CVE-2026-45852","CVE-2026-46054","CVE-2026-46086","CVE-2026-46116","CVE-2026-46173","CVE-2026-46181","CVE-2026-46242","CVE-2026-46259","CVE-2026-46300","CVE-2026-46331","CVE-2026-46333","CVE-2026-46917","CVE-2026-46968","CVE-2026-47010","CVE-2026-47021","CVE-2026-47027","CVE-2026-47059","CVE-2026-47063","CVE-2026-48144","CVE-2026-48145","CVE-2026-5260","CVE-2026-52923","CVE-2026-52991","CVE-2026-53006","CVE-2026-53009","CVE-2026-53131","CVE-2026-53189","CVE-2026-53264","CVE-2026-53266","CVE-2026-5419","CVE-2026-5450","CVE-2026-55602","CVE-2026-55603","CVE-2026-55968","CVE-2026-55970","CVE-2026-58010","CVE-2026-58011","CVE-2026-58012","CVE-2026-58013","CVE-2026-58014","CVE-2026-58015","CVE-2026-58016","CVE-2026-58662","CVE-2026-59879","CVE-2026-59880","CVE-2026-60147","CVE-2026-60589","CVE-2026-61308","CVE-2026-63913","CVE-2026-63952","CVE-2026-64017","CVE-2026-64530","CVE-2026-64560","CVE-2026-70906","CVE-2026-70907","CVE-2026-74581","CVE-2026-82417","CVE-2026-82562","CVE-2026-83605","CVE-2026-83607","CVE-2026-83608","CVE-2026-83613","CVE-2026-83614","CVE-2026-83615","CVE-2026-83616","CVE-2026-83619"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-6720","identifiers":["EUVD-2026-6720","CVE-2026-2391","GHSA-w7fw-mjwx-w883"]},"retained":false,"historicalAffected":[]}],"coverage":[]}