GHSA-6rw7-vpxm-498pPublished
arrayLimit bypass in bracket notation allows DoS via memory exhaustion
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2025-15284 · Microsoft / collected KEV context
cve-program · CVE-2025-15284
- https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p
- https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9
euvd · EUVD-2025-205660
- https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p
- https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9
nvd · CVE-2025-15284
- https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9
- https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p
osv · GHSA-6rw7-vpxm-498p
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.