PatchSiren cyber security CVE debrief

CVE-2026-82562 ljharb CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-30T01:20:32.820Z and has not been modified since then. CVE-2026-82562 is a vulnerability in the qs library where a specially crafted query string can bypass the array limit when parsed with certain options (comma: true and throwOnLimitExceeded: true), potentially leading to a DOS attack. The vulnerability arises from the library's handling of comma-separated values under a bracket-push key (a[]=1,2,3,4), which allows for an inner array of arbitrary length. This occurs because the arrayLimit check runs after wrapping the comma-separated value as a single nested element. The fix for this vulnerability is included in qs version 6.16.0 or later. An unauthenticated attacker who can reach an application that parses untrusted query strings or urlencoded bodies with both `comma: true` and `throwOnLimitExceeded: true` (both non-default) can bypass the configured limit with a single `a[]=` parameter and force the parser to allocate an array proportional to the request size. The cost is strictly linear in the attacker-supplied bytes (about 0.1 microseconds and 6 to 7 retained bytes per input byte; the same out-of-memory threshold as the documented default `throwOnLimitExceeded: false` path), so a transport-layer request or body size limit bounds it completely (and node's default maximum HTTP header size of 16 KB already bounds the request line, so multi-megabyte payloads need a body parser). The impact is that an opt-in hard limit fails open on one key spelling, not unbounded allocation from a small input. Evidence is based on official CVE and NVD records, alongside limited source references from GitHub. Further verification is recommended through direct code review and testing.

Vendor: ljharb
Product: qs
CVSS: MEDIUM 6.3
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-08-30
Original CVE updated: 2026-08-30
Advisory published: 2026-08-30
Advisory updated: 2026-08-30

Who should care

Developers and administrators using the qs library in applications that parse untrusted query strings or URL-encoded bodies with specific options (comma: true and throwOnLimitExceeded: true) should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and applying patches, restricting parsing to trusted sources, implementing size limits, and monitoring for potential exploitation attempts. Affected operators, platforms, and security teams should prioritize patching and compensating controls.

Technical summary

CVE-2026-82562 is a vulnerability in the qs library where a specially crafted query string can bypass the array limit when parsed with certain options (comma: true and throwOnLimitExceeded: true), potentially leading to a DOS attack. The vulnerability arises from the library's handling of comma-separated values under a bracket-push key (a[]=1,2,3,4), which allows for an inner array of arbitrary length. This occurs because the arrayLimit check runs after wrapping the comma-separated value as a single nested element. The fix for this vulnerability is included in qs version 6.16.0 or later.

Defensive priority

Medium-priority defensive tasks are recommended given the CVE's MEDIUM CVSS score of 6.3 and potential for limited DOS attacks through query string parsing.

Recommended defensive actions

Review and apply the patch from qs version 6.16.0 or later
Restrict query string and URL-encoded body parsing to trusted sources
Implement transport-layer request or body size limits to mitigate potential DOS
Monitor for and respond to potential exploitation attempts
Update affected applications and libraries to the latest version

Evidence notes

Evidence is based on official CVE and NVD records, alongside limited source references from GitHub. Further verification is recommended through direct code review and testing. The CVE record was published on 2026-08-30T01:20:32.820Z and has not been modified since then. The qs library's handling of comma-separated values under a bracket-push key (a[]=1,2,3,4) allows for an inner array of arbitrary length even when the caller opts into the hard limit with throwOnLimitExceeded: true. This occurs because the arrayLimit check runs after wrapping the comma-separated value as a single nested element, so it only sees a wrapper of length 1. To verify, defenders should review the official advisory, perform direct code review, and test query string parsing with specific options.

Sources and references

Verified primary and authoritative sources

CVE-2026-82562 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-82562

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-82562 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-82562

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464

7ffcee3d-2c14-4c3e-b844-86c6a321a158
Source reference
Unverified legacy reference

URL: https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883

7ffcee3d-2c14-4c3e-b844-86c6a321a158
Source reference
Unverified legacy reference

URL: https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx

7ffcee3d-2c14-4c3e-b844-86c6a321a158

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.