qs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391)

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-82562 · CVE overview and exploitation status

EUVD-2026-68141

GHSA-x5fp-wj9c-mxmx

cve-program · CVE-2026-82562

• https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx
• https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464
• https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883

euvd · EUVD-2026-68141

• https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx
• https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464
• https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883

nvd · CVE-2026-82562

• https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464
• https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883
• https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx

osv · GHSA-x5fp-wj9c-mxmx

• https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883
• https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx
• https://nvd.nist.gov/vuln/detail/CVE-2026-82562
• https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464
• https://github.com/ljharb/qs

• ### Summary · Advisory content revised · 5 Nov 2026
• ### Summary · Advisory content revised · 1 Nov 2026