CVE-2026-82562: qs array-limit bypass via bracket-key comma parsing

September 2, 2026

qs v6.15.3 allows bracket-key input to bypass arrayLimit and throwOnLimitExceeded when comma: true. The input a[]=1,2,3,4 succeeds with arrayLimit: 3, while the equivalent plain-key input is rejected.

Affected version tested:

qs v6.15.3
commit 18d085e919dae70c8f1b200ab99323058edab2c2

References

github.com/advisories/GHSA-x5fp-wj9c-mxmx
github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464
github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883
github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx
nvd.nist.gov/vuln/detail/CVE-2026-82562

Code Behaviors & Features

Detect and mitigate CVE-2026-82562 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →