{"id":"CVE-2025-15284","aliases":["ALSA-2026:18480","ALSA-2026:18868","AZL-73316","AZL-73319","AZL-73353","AZL-73359","CLSA-2026-1773101688","CLSA-2026-1773101691","CLSA-2026-1773274548","CLSA-2026-1773274550","CLSA-2026-1776299673","CLSA-2026-1784509773","CLSA-2026-1784683089","CLSA-2026-1784769524","CLSA-2026-1784769609","CLSA-2026-1790521454","CLSA-2026-1791373797","CLSA-2026-1791626635","CLSA-2026-1791806891","CLSA-2026-1792160905","CLSA-2026-1792164286","CLSA-2026-1792164375","CLSA-2026-1792447268","CLSA-2026-1792476180","CLSA-2026-1792763694","CLSA-2026-1793015893","CLSA-2026-1793867524","DEBIAN-CVE-2025-15284","EUVD-2025-205660","GHSA-6rw7-vpxm-498p","RHSA-2026:18480","RHSA-2026:18868","RHSA-2026:33371","RLSA-2026:18480","RLSA-2026:18868","ROOT-APP-NPM-CVE-2025-15284","UBUNTU-CVE-2025-15284"],"status":"published","title":"arrayLimit bypass in bracket notation allows DoS via memory exhaustion","description":"Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: \u003c 6.14.1.\n\n\nSummary\n\nThe arrayLimit option in qs did not enforce limits for bracket notation (a[]=1\u0026a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations.\n\nNote: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.\n\nDetails\n\nThe arrayLimit option only checked limits for indexed notation (a[0]=1\u0026a[1]=2) but did not enforce it for bracket notation (a[]=1\u0026a[]=2).\n\nVulnerable code (lib/parse.js:159-162):\n\nif (root === '[]' \u0026\u0026 options.parseArrays) {\n    obj = utils.combine([], leaf);  // No arrayLimit check\n}\n\n\n\n\n\nWorking code (lib/parse.js:175):\n\nelse if (index \u003c= options.arrayLimit) {  // Limit checked here\n    obj = [];\n    obj[index] = leaf;\n}\n\n\n\n\n\nThe bracket notation handler at line 159 uses utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175 checks index \u003c= options.arrayLimit before creating arrays.\n\n\n\nPoC\n\nconst qs = require('qs');\nconst result = qs.parse('a[]=1\u0026a[]=2\u0026a[]=3\u0026a[]=4\u0026a[]=5\u0026a[]=6', { arrayLimit: 5 });\nconsole.log(result.a.length);  // Output: 6 (should be max 5)\n\n\n\n\n\nNote on parameterLimit interaction: The original advisory's \"DoS demonstration\" claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.\n\nImpact\n\nConsistency bug in arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit is explicitly set to a very high value.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0045,"percentile":0.39511,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2025-12-29T22:56:45Z","modified":"2026-11-05T13:15:12Z","fixes":[{"ecosystem":"npm","package":"qs","fixed_in":["6.14.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"qs","fixed_in":["6.5.3-tuxcare.1","6.5.5-tuxcare.1","6.4.3-tuxcare.2","6.2.6-tuxcare.2","1.0.2-tuxcare.1","6.14.0-tuxcare.6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-qs","fixed_in":["6.14.1+ds+~6.14.0-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"qs","fixed_in":["6.11.0-aikido.2","6.11.2-aikido.1","6.13.0-aikido.2","6.5.5-aikido.2","6.14.0-aikido.3","6.11.0-aikido.3","6.14.0-aikido.4","4.0.0-aikido.1","6.5.3-aikido.2","6.5.2-aikido.3","6.7.0-aikido.2","6.7.0-aikido.3","6.14.1-aikido.2","6.14.1-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/qs","fixed_in":["6.11.0-root.io.2","6.14.0-root.io.1","6.11.2-root.io.1","6.14.0-root.io.2","6.13.0-root.io.1","6.11.0-root.io.1","6.5.5-root.io.1","6.13.0-root.io.2","6.5.5-root.io.2","6.14.0-root.io.3","6.11.0-root.io.3","6.14.0-root.io.4","4.0.0-root.io.1","6.5.3-root.io.2","6.5.2-root.io.3","6.7.0-root.io.2","6.7.0-root.io.3","6.14.1-root.io.1","6.14.1-root.io.2","6.14.1-root.io.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"sgx-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"sgx-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"sgx-mpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"sgx-pccs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"sgx-pccs-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"sgx-pckid-tool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tdx-qgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"sgx-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"sgx-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"sgx-mpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"sgx-pccs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"sgx-pccs-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"sgx-pckid-tool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tdx-qgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.3-5"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.3-4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0-tuxcare.0"},{"fixed":"5.2.0-tuxcare.1"}]}],"versions":["5.2.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0-tuxcare.0"},{"fixed":"5.1.0-tuxcare.1"}]}],"versions":["5.1.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.3-tuxcare.0"},{"fixed":"6.5.3-tuxcare.1"}]}],"versions":["6.5.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.3-tuxcare.0"},{"fixed":"2.3.3-tuxcare.1"}]}],"versions":["2.3.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.5-tuxcare.0"},{"fixed":"6.5.5-tuxcare.1"}]}],"versions":["6.5.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.1-tuxcare.0"},{"fixed":"5.2.1-tuxcare.1"}]}],"versions":["5.2.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.10.7-tuxcare.0"},{"fixed":"6.10.7-tuxcare.1"}]}],"versions":["6.10.7"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.10.3-tuxcare.0"},{"fixed":"6.10.3-tuxcare.1"}]}],"versions":["6.10.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0-tuxcare.0"},{"fixed":"6.7.0-tuxcare.2"}]}],"versions":["6.7.0","6.7.0-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0-tuxcare.0"},{"fixed":"6.13.0-tuxcare.1"}]}],"versions":["6.13.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.6.5-tuxcare.0"},{"fixed":"0.6.5-tuxcare.1"}]}],"versions":["0.6.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.3-tuxcare.0"},{"fixed":"6.4.3-tuxcare.2"}]}],"versions":["6.4.3","6.4.3-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.6-tuxcare.0"},{"fixed":"6.2.6-tuxcare.2"}]}],"versions":["6.2.6","6.2.6-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.2-tuxcare.0"},{"fixed":"1.0.2-tuxcare.1"}]}],"versions":["1.0.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.2-tuxcare.0"},{"fixed":"6.11.2-tuxcare.1"}]}],"versions":["6.11.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.10.4-tuxcare.0"},{"fixed":"6.10.4-tuxcare.1"}]}],"versions":["6.10.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.1-tuxcare.0"},{"fixed":"6.5.1-tuxcare.1"}]}],"versions":["6.5.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1-tuxcare.0"},{"fixed":"6.2.1-tuxcare.1"}]}],"versions":["6.2.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.3-tuxcare.0"},{"fixed":"6.5.3-tuxcare.2"}]}],"versions":["6.5.3","6.5.3-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.2-tuxcare.0"},{"fixed":"0.4.2-tuxcare.1"}]}],"versions":["0.4.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.14.0-tuxcare.0"},{"fixed":"6.14.0-tuxcare.6"}]}],"versions":["6.14.0","6.14.0-tuxcare.1","6.14.0-tuxcare.2","6.14.0-tuxcare.3","6.14.0-tuxcare.4","6.14.0-tuxcare.5"]},{"source":"osv","ecosystem":"Debian:12","package":"node-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0+ds+~6.9.7-3","6.11.0+ds+~6.9.7-4","6.13.0+ds+~6.9.16-1","6.14.1+ds+~6.14.0-1","6.15.0+ds+~6.15.0-1","6.15.0+ds+~6.15.0-2","6.15.0+ds+~6.15.0-3","6.15.2+ds+~6.15.1-1","6.16.0+ds+~6.15.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.13.0+ds+~6.9.16-1","6.14.1+ds+~6.14.0-1","6.15.0+ds+~6.15.0-1","6.15.0+ds+~6.15.0-2","6.15.0+ds+~6.15.0-3","6.15.2+ds+~6.15.1-1","6.16.0+ds+~6.15.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.1+ds+~6.14.0-1"}]}],"versions":["6.13.0+ds+~6.9.16-1"]},{"source":"osv","ecosystem":"npm","package":"qs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.14.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"linux-sgx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"linux-sgx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"linux-sgx-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-enclave-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-mpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-mpa-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-pccs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-pccs-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-pccs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-pckid-tool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"sgx-pckid-tool-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tdx-attest-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tdx-qgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tdx-qgs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"linux-sgx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"linux-sgx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"linux-sgx-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-enclave-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-mpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-mpa-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-pccs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-pccs-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-pccs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-pckid-tool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"sgx-pckid-tool-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tdx-attest-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tdx-qgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tdx-qgs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.18-3.GA_redhat_00001.1.el7eap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.18-3.GA_redhat_00001.1.el7eap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly-java-jdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.18-3.GA_redhat_00001.1.el7eap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly-javadocs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.18-3.GA_redhat_00001.1.el7eap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.18-3.GA_redhat_00001.1.el7eap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.41-8.SP9_redhat_00001.1.el7eap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-apache-cxf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-4.SP2_redhat_00004.1.el7eap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-apache-cxf-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-4.SP2_redhat_00004.1.el7eap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-apache-cxf-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-4.SP2_redhat_00004.1.el7eap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-apache-cxf-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-4.SP2_redhat_00004.1.el7eap"}]}],"bundled":11},{"source":"osv","ecosystem":"Rocky Linux:10","package":"linux-sgx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el10"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:9","package":"linux-sgx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.26-7.el9"}]}],"bundled":5},{"source":"osv","ecosystem":"Root:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.0-aikido.2"},{"fixed":"6.11.2-aikido.1"},{"fixed":"6.13.0-aikido.2"},{"fixed":"6.5.5-aikido.2"},{"fixed":"6.14.0-aikido.3"},{"fixed":"6.11.0-aikido.3"},{"fixed":"6.14.0-aikido.4"},{"fixed":"4.0.0-aikido.1"},{"fixed":"6.5.3-aikido.2"},{"fixed":"6.5.2-aikido.3"},{"fixed":"6.7.0-aikido.2"},{"fixed":"6.7.0-aikido.3"},{"fixed":"6.14.1-aikido.2"},{"fixed":"6.14.1-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.0-root.io.2"},{"fixed":"6.14.0-root.io.1"},{"fixed":"6.11.2-root.io.1"},{"fixed":"6.14.0-root.io.2"},{"fixed":"6.13.0-root.io.1"},{"fixed":"6.11.0-root.io.1"},{"fixed":"6.5.5-root.io.1"},{"fixed":"6.13.0-root.io.2"},{"fixed":"6.5.5-root.io.2"},{"fixed":"6.14.0-root.io.3"},{"fixed":"6.11.0-root.io.3"},{"fixed":"6.14.0-root.io.4"},{"fixed":"4.0.0-root.io.1"},{"fixed":"6.5.3-root.io.2"},{"fixed":"6.5.2-root.io.3"},{"fixed":"6.7.0-root.io.2"},{"fixed":"6.7.0-root.io.3"},{"fixed":"6.14.1-root.io.1"},{"fixed":"6.14.1-root.io.2"},{"fixed":"6.14.1-root.io.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"node-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.2-1","0.6.5-1","0.6.5-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"node-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.4-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.4-1","2.2.4-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.2-1","6.9.0+ds-1","6.9.1+ds-1","6.9.1+ds-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.9.4+ds-1","6.10.1+ds-1","6.10.2+ds+~6.9.7-1","6.10.3+ds+~6.9.7-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0+ds+~6.9.7-3","6.11.0+ds+~6.9.7-4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.13.0+ds+~6.9.16-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.13.0+ds+~6.9.16-1","6.14.1+ds+~6.14.0-1"]}],"products":[{"vendor":"qs_project","product":"qs"}],"references":[{"url":"https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p","tags":["vendor-advisory","Exploit","Mitigation","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9","tags":["patch","Patch","fix","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15284","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-6rw7-vpxm-498p"},{"url":"https://access.redhat.com/errata/RHSA-2026:18480","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-13465","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15284","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-23745","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-23950","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-24842","tags":["report"]},{"url":"https://bugzilla.redhat.com/2425946","tags":["report"]},{"url":"https://bugzilla.redhat.com/2430538","tags":["report"]},{"url":"https://bugzilla.redhat.com/2431036","tags":["report"]},{"url":"https://bugzilla.redhat.com/2431740","tags":["report"]},{"url":"https://bugzilla.redhat.com/2433645","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-18480.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:18868","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-18868.html","tags":["advisory"]},{"url":"https://npmjs.com/qs","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15284.json","tags":["advisory"]},{"url":"https://github.com/ljharb/qs","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-15284","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/10.2_release_notes/index","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2425946","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430538","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431036","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431740","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2433645","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-110112","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-121612","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-140108","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_18480.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-13465","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13465","tags":["advisory"]},{"url":"https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15284","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-23745","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23745","tags":["advisory"]},{"url":"https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e","tags":["article"]},{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-23950","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23950","tags":["advisory"]},{"url":"https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6","tags":["article"]},{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-24842","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24842","tags":["advisory"]},{"url":"https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46","tags":["article"]},{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.8_release_notes/index","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-127046","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-140109","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_18868.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:33371","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/index","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3/html/7.3.0_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2339095","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2392306","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2408784","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2423194","tags":["report"]},{"url":"https://issues.redhat.com/browse/JBEAP-31703","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-33004","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_33371.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-29371","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-29371","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29371","tags":["advisory"]},{"url":"https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-9784","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9784","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9784","tags":["advisory"]},{"url":"https://github.com/undertow-io/undertow/pull/1778","tags":["article"]},{"url":"https://github.com/undertow-io/undertow/releases/tag/2.2.38.Final","tags":["article"]},{"url":"https://issues.redhat.com/browse/UNDERTOW-2598","tags":["article"]},{"url":"https://kb.cert.org/vuls/id/767506","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-12543","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-12543","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12543","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-23184","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-23184","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23184","tags":["advisory"]},{"url":"https://lists.apache.org/thread/lfs8l63rnctnj2skfrxyys7v8fgnt122","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-23368","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2337621","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-23368","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23368","tags":["advisory"]},{"url":"https://www.gruppotim.it/it/footer/red-team.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-66412","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2418155","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-66412","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66412","tags":["advisory"]},{"url":"https://github.com/angular/angular/commit/1c6b0704fb63d051fab8acff84d076abfbc4893a","tags":["article"]},{"url":"https://github.com/angular/angular/security/advisories/GHSA-v4hv-rgfq-gp49","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-69873","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2439070","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69873","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69873","tags":["advisory"]},{"url":"https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1002","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430180","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1002","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1002","tags":["advisory"]},{"url":"https://github.com/eclipse-vertx/vert.x/pull/5895","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2026:18480","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:18868","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-15284","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-15284","title":"arrayLimit bypass in bracket notation allows DoS via memory exhaustion","description":"Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: \u003c 6.14.1.\n\n\nSummary\n\nThe arrayLimit option in qs did not enforce limits for bracket notation (a[]=1\u0026a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations.\n\nNote: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.\n\nDetails\n\nThe arrayLimit option only checked limits for indexed notation (a[0]=1\u0026a[1]=2) but did not enforce it for bracket notation (a[]=1\u0026a[]=2).\n\nVulnerable code (lib/parse.js:159-162):\n\nif (root === '[]' \u0026\u0026 options.parseArrays) {\n    obj = utils.combine([], leaf);  // No arrayLimit check\n}\n\n\n\n\n\nWorking code (lib/parse.js:175):\n\nelse if (index \u003c= options.arrayLimit) {  // Limit checked here\n    obj = [];\n    obj[index] = leaf;\n}\n\n\n\n\n\nThe bracket notation handler at line 159 uses utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175 checks index \u003c= options.arrayLimit before creating arrays.\n\n\n\nPoC\n\nconst qs = require('qs');\nconst result = qs.parse('a[]=1\u0026a[]=2\u0026a[]=3\u0026a[]=4\u0026a[]=5\u0026a[]=6', { arrayLimit: 5 });\nconsole.log(result.a.length);  // Output: 6 (should be max 5)\n\n\n\n\n\nNote on parameterLimit interaction: The original advisory's \"DoS demonstration\" claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.\n\nImpact\n\nConsistency bug in arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit is explicitly set to a very high value.","status":"published","published":"2025-12-29T22:56:45.24Z","modified":"2026-02-10T20:06:42.111Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","level":"medium","assessor":"cna"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:32:37.351404Z"}],"euvd":[{"id":"EUVD-2025-205660","description":"Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: \u003c 6.14.1.\n\n\nSummary\n\nThe arrayLimit option in qs did not enforce limits for bracket notation (a[]=1\u0026a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations.\n\nNote: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.\n\nDetails\n\nThe arrayLimit option only checked limits for indexed notation (a[0]=1\u0026a[1]=2) but did not enforce it for bracket notation (a[]=1\u0026a[]=2).\n\nVulnerable code (lib/parse.js:159-162):\n\nif (root === '[]' \u0026\u0026 options.parseArrays) {\n    obj = utils.combine([], leaf);  // No arrayLimit check\n}\n\n\n\n\n\nWorking code (lib/parse.js:175):\n\nelse if (index \u003c= options.arrayLimit) {  // Limit checked here\n    obj = [];\n    obj[index] = leaf;\n}\n\n\n\n\n\nThe bracket notation handler at line 159 uses utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175 checks index \u003c= options.arrayLimit before creating arrays.\n\n\n\nPoC\n\nconst qs = require('qs');\nconst result = qs.parse('a[]=1\u0026a[]=2\u0026a[]=3\u0026a[]=4\u0026a[]=5\u0026a[]=6', { arrayLimit: 5 });\nconsole.log(result.a.length);  // Output: 6 (should be max 5)\n\n\n\n\n\nNote on parameterLimit interaction: The original advisory's \"DoS demonstration\" claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.\n\nImpact\n\nConsistency bug in arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit is explicitly set to a very high value.","status":"published","published":"2025-12-29T22:56:45Z","modified":"2026-02-10T20:06:42Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","level":"medium"}],"updated_at":"2026-11-02T19:48:41.699812Z"}],"ghsa":[{"id":"GHSA-6rw7-vpxm-498p","title":"qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion","description":"### Summary\n\nThe `arrayLimit` option in qs did not enforce limits for bracket notation (`a[]=1\u0026a[]=2`), only for indexed notation (`a[0]=1`). This is a consistency bug; `arrayLimit` should apply uniformly across all array notations.\n\n**Note:** The default `parameterLimit` of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than `parameterLimit` regardless of `arrayLimit`, because each `a[]=value` consumes one parameter slot. The severity has been reduced accordingly.\n\n### Details\n\nThe `arrayLimit` option only checked limits for indexed notation (`a[0]=1\u0026a[1]=2`) but did not enforce it for bracket notation (`a[]=1\u0026a[]=2`).\n\n**Vulnerable code** (`lib/parse.js:159-162`):\n```javascript\nif (root === '[]' \u0026\u0026 options.parseArrays) {\n    obj = utils.combine([], leaf);  // No arrayLimit check\n}\n```\n\n**Working code** (`lib/parse.js:175`):\n```javascript\nelse if (index \u003c= options.arrayLimit) {  // Limit checked here\n    obj = [];\n    obj[index] = leaf;\n}\n```\n\nThe bracket notation handler at line 159 uses `utils.combine([], leaf)` without validating against `options.arrayLimit`, while indexed notation at line 175 checks `index \u003c= options.arrayLimit` before creating arrays.\n\n### PoC\n\n```javascript\nconst qs = require('qs');\nconst result = qs.parse('a[]=1\u0026a[]=2\u0026a[]=3\u0026a[]=4\u0026a[]=5\u0026a[]=6', { arrayLimit: 5 });\nconsole.log(result.a.length);  // Output: 6 (should be max 5)\n```\n\n**Note on parameterLimit interaction:** The original advisory's \"DoS demonstration\" claimed a length of 10,000, but `parameterLimit` (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.\n\n### Impact\n\nConsistency bug in `arrayLimit` enforcement. With default `parameterLimit`, the practical DoS risk is negligible since `parameterLimit` already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when `parameterLimit` is explicitly set to a very high value.","status":"published","published":"2025-12-30T21:02:54Z","modified":"2026-03-02T22:05:33Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","level":"medium"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:39:30.031684Z"}],"nvd":[{"id":"CVE-2025-15284","description":"Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: \u003c 6.14.1.\n\n\nSummary\n\nThe arrayLimit option in qs did not enforce limits for bracket notation (a[]=1\u0026a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations.\n\nNote: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.\n\nDetails\n\nThe arrayLimit option only checked limits for indexed notation (a[0]=1\u0026a[1]=2) but did not enforce it for bracket notation (a[]=1\u0026a[]=2).\n\nVulnerable code (lib/parse.js:159-162):\n\nif (root === '[]' \u0026\u0026 options.parseArrays) {\n    obj = utils.combine([], leaf);  // No arrayLimit check\n}\n\n\n\n\n\nWorking code (lib/parse.js:175):\n\nelse if (index \u003c= options.arrayLimit) {  // Limit checked here\n    obj = [];\n    obj[index] = leaf;\n}\n\n\n\n\n\nThe bracket notation handler at line 159 uses utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175 checks index \u003c= options.arrayLimit before creating arrays.\n\n\n\nPoC\n\nconst qs = require('qs');\nconst result = qs.parse('a[]=1\u0026a[]=2\u0026a[]=3\u0026a[]=4\u0026a[]=5\u0026a[]=6', { arrayLimit: 5 });\nconsole.log(result.a.length);  // Output: 6 (should be max 5)\n\n\n\n\n\nNote on parameterLimit interaction: The original advisory's \"DoS demonstration\" claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.\n\nImpact\n\nConsistency bug in arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit is explicitly set to a very high value.","status":"published","published":"2025-12-29T23:15:42.703Z","modified":"2026-10-14T19:10:00.297Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:11:53.683969Z"}],"osv":[{"id":"CVE-2025-15284","title":"arrayLimit bypass in bracket notation allows DoS via memory exhaustion","description":"Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: \u003c 6.14.1.\n\n\nSummary\n\nThe arrayLimit option in qs did not enforce limits for bracket notation (a[]=1\u0026a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations.\n\nNote: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.\n\nDetails\n\nThe arrayLimit option only checked limits for indexed notation (a[0]=1\u0026a[1]=2) but did not enforce it for bracket notation (a[]=1\u0026a[]=2).\n\nVulnerable code (lib/parse.js:159-162):\n\nif (root === '[]' \u0026\u0026 options.parseArrays) {\n    obj = utils.combine([], leaf);  // No arrayLimit check\n}\n\n\n\n\n\nWorking code (lib/parse.js:175):\n\nelse if (index \u003c= options.arrayLimit) {  // Limit checked here\n    obj = [];\n    obj[index] = leaf;\n}\n\n\n\n\n\nThe bracket notation handler at line 159 uses utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175 checks index \u003c= options.arrayLimit before creating arrays.\n\n\n\nPoC\n\nconst qs = require('qs');\nconst result = qs.parse('a[]=1\u0026a[]=2\u0026a[]=3\u0026a[]=4\u0026a[]=5\u0026a[]=6', { arrayLimit: 5 });\nconsole.log(result.a.length);  // Output: 6 (should be max 5)\n\n\n\n\n\nNote on parameterLimit interaction: The original advisory's \"DoS demonstration\" claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.\n\nImpact\n\nConsistency bug in arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit is explicitly set to a very high value.","status":"published","published":"2025-12-29T22:56:45.24Z","modified":"2026-10-28T02:30:49.045541279Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:44:46.340268Z"},{"id":"DEBIAN-CVE-2025-15284","description":"Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: \u003c 6.14.1.   Summary  The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1\u0026a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations.  Note: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.  Details  The arrayLimit option only checked limits for indexed notation (a[0]=1\u0026a[1]=2) but did not enforce it for bracket notation (a[]=1\u0026a[]=2).  Vulnerable code (lib/parse.js:159-162):  if (root === '[]' \u0026\u0026 options.parseArrays) {     obj = utils.combine([], leaf);  // No arrayLimit check }      Working code (lib/parse.js:175):  else if (index \u003c= options.arrayLimit) {  // Limit checked here     obj = [];     obj[index] = leaf; }      The bracket notation handler at line 159 uses utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175 checks index \u003c= options.arrayLimit before creating arrays.    PoC  const qs = require('qs'); const result = qs.parse('a[]=1\u0026a[]=2\u0026a[]=3\u0026a[]=4\u0026a[]=5\u0026a[]=6', { arrayLimit: 5 }); console.log(result.a.length);  // Output: 6 (should be max 5)      Note on parameterLimit interaction: The original advisory's \"DoS demonstration\" claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.  Impact  Consistency bug in arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit is explicitly set to a very high value.","status":"published","published":"2025-12-29T23:15:42.703Z","modified":"2026-10-15T09:47:44.335825014Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:45.102284Z"},{"id":"GHSA-6rw7-vpxm-498p","title":"qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion","description":"### Summary\n\nThe `arrayLimit` option in qs did not enforce limits for bracket notation (`a[]=1\u0026a[]=2`), only for indexed notation (`a[0]=1`). This is a consistency bug; `arrayLimit` should apply uniformly across all array notations.\n\n**Note:** The default `parameterLimit` of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than `parameterLimit` regardless of `arrayLimit`, because each `a[]=value` consumes one parameter slot. The severity has been reduced accordingly.\n\n### Details\n\nThe `arrayLimit` option only checked limits for indexed notation (`a[0]=1\u0026a[1]=2`) but did not enforce it for bracket notation (`a[]=1\u0026a[]=2`).\n\n**Vulnerable code** (`lib/parse.js:159-162`):\n```javascript\nif (root === '[]' \u0026\u0026 options.parseArrays) {\n    obj = utils.combine([], leaf);  // No arrayLimit check\n}\n```\n\n**Working code** (`lib/parse.js:175`):\n```javascript\nelse if (index \u003c= options.arrayLimit) {  // Limit checked here\n    obj = [];\n    obj[index] = leaf;\n}\n```\n\nThe bracket notation handler at line 159 uses `utils.combine([], leaf)` without validating against `options.arrayLimit`, while indexed notation at line 175 checks `index \u003c= options.arrayLimit` before creating arrays.\n\n### PoC\n\n```javascript\nconst qs = require('qs');\nconst result = qs.parse('a[]=1\u0026a[]=2\u0026a[]=3\u0026a[]=4\u0026a[]=5\u0026a[]=6', { arrayLimit: 5 });\nconsole.log(result.a.length);  // Output: 6 (should be max 5)\n```\n\n**Note on parameterLimit interaction:** The original advisory's \"DoS demonstration\" claimed a length of 10,000, but `parameterLimit` (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.\n\n### Impact\n\nConsistency bug in `arrayLimit` enforcement. With default `parameterLimit`, the practical DoS risk is negligible since `parameterLimit` already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when `parameterLimit` is explicitly set to a very high value.","status":"published","published":"2025-12-30T21:02:54Z","modified":"2026-09-10T03:50:31.670581449Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:39.965326Z"},{"id":"RHSA-2026:18480","title":"Red Hat Security Advisory: linux-sgx security update","status":"published","published":"2026-05-19T10:06:40Z","modified":"2026-10-16T10:12:07Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:18868","title":"Red Hat Security Advisory: linux-sgx security update","status":"published","published":"2026-05-20T10:09:29Z","modified":"2026-10-16T10:12:09Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:33371","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.18 security update","status":"published","published":"2026-06-30T10:49:44Z","modified":"2026-10-20T10:07:22Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L","level":"critical"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RLSA-2026:18480","title":"Important: linux-sgx security update","description":"The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software developers to create and debug Intel SGX enabled applications in C/C++.\n\nSecurity Fix(es):\n\n* qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)\n\n* node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives (CVE-2026-23745)\n\n* node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition (CVE-2026-23950)\n\n* lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)\n\n* node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check (CVE-2026-24842)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.","status":"published","published":"2026-05-29T16:03:45.659533Z","modified":"2026-05-29T16:30:23.740685725Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2026:18868","title":"Important: linux-sgx security update","description":"The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software developers to create and debug Intel SGX enabled applications in C/C++.\n\nSecurity Fix(es):\n\n* qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)\n\n* node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives (CVE-2026-23745)\n\n* node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition (CVE-2026-23950)\n\n* lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)\n\n* node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check (CVE-2026-24842)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.","status":"published","published":"2026-05-28T15:43:06.024531Z","modified":"2026-05-28T16:00:24.767658806Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"ROOT-APP-NPM-CVE-2025-15284","title":"CVE-2025-15284 in qs - Patched by Root","description":"Root has patched CVE-2025-15284 in the qs package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-01T06:15:38Z","modified":"2026-10-01T07:15:06.927783073Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"UBUNTU-CVE-2025-15284","description":"Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: \u003c 6.14.1. Summary The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1\u0026a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations. Note: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly. Details The arrayLimit option only checked limits for indexed notation (a[0]=1\u0026a[1]=2) but did not enforce it for bracket notation (a[]=1\u0026a[]=2). Vulnerable code (lib/parse.js:159-162): if (root === '[]' \u0026\u0026 options.parseArrays) {     obj = utils.combine([], leaf);  // No arrayLimit check } Working code (lib/parse.js:175): else if (index \u003c= options.arrayLimit) {  // Limit checked here     obj = [];     obj[index] = leaf; } The bracket notation handler at line 159 uses utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175 checks index \u003c= options.arrayLimit before creating arrays. PoC const qs = require('qs'); const result = qs.parse('a[]=1\u0026a[]=2\u0026a[]=3\u0026a[]=4\u0026a[]=5\u0026a[]=6', { arrayLimit: 5 }); console.log(result.a.length);  // Output: 6 (should be max 5) Note on parameterLimit interaction: The original advisory's \"DoS demonstration\" claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000. Impact Consistency bug in arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit is explicitly set to a very high value.","status":"published","published":"2025-12-29T23:15:00Z","modified":"2026-05-20T16:20:24.338509507Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","level":"medium"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"ALSA-2026:18480","title":"Important: linux-sgx security update","description":"The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software developers to create and debug Intel SGX enabled applications in C/C++.  \n\nSecurity Fix(es):  \n\n  * qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)\n  * node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives (CVE-2026-23745)\n  * node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition (CVE-2026-23950)\n  * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)\n  * node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check (CVE-2026-24842)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.\n","status":"published","published":"2026-05-19T00:00:00Z","modified":"2026-10-29T11:30:15.225622392Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2026:18868","title":"Important: linux-sgx security update","description":"The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software developers to create and debug Intel SGX enabled applications in C/C++.  \n\nSecurity Fix(es):  \n\n  * qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)\n  * node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives (CVE-2026-23745)\n  * node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition (CVE-2026-23950)\n  * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)\n  * node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check (CVE-2026-24842)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.\n","status":"published","published":"2026-05-19T00:00:00Z","modified":"2026-10-29T11:32:30.97810048Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"AZL-73316","title":"CVE-2025-15284 affecting package js-jquery 3.5.0-4","description":"Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: \u003c 6.14.1.\n\n\nSummary\n\nThe arrayLimit option in qs did not enforce limits for bracket notation (a[]=1\u0026a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations.\n\nNote: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.\n\nDetails\n\nThe arrayLimit option only checked limits for indexed notation (a[0]=1\u0026a[1]=2) but did not enforce it for bracket notation (a[]=1\u0026a[]=2).\n\nVulnerable code (lib/parse.js:159-162):\n\nif (root === '[]' \u0026\u0026 options.parseArrays) {\n    obj = utils.combine([], leaf);  // No arrayLimit check\n}\n\n\n\n\n\nWorking code (lib/parse.js:175):\n\nelse if (index \u003c= options.arrayLimit) {  // Limit checked here\n    obj = [];\n    obj[index] = leaf;\n}\n\n\n\n\n\nThe bracket notation handler at line 159 uses utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175 checks index \u003c= options.arrayLimit before creating arrays.\n\n\n\nPoC\n\nconst qs = require('qs');\nconst result = qs.parse('a[]=1\u0026a[]=2\u0026a[]=3\u0026a[]=4\u0026a[]=5\u0026a[]=6', { arrayLimit: 5 });\nconsole.log(result.a.length);  // Output: 6 (should be max 5)\n\n\n\n\n\nNote on parameterLimit interaction: The original advisory's \"DoS demonstration\" claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.\n\nImpact\n\nConsistency bug in arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit is explicitly set to a very high value.","status":"published","published":"2025-12-29T23:15:42Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:24.309973Z"},{"id":"AZL-73319","title":"CVE-2025-15284 affecting package nodejs-nodemon 2.0.3-5","description":"Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: \u003c 6.14.1.\n\n\nSummary\n\nThe arrayLimit option in qs did not enforce limits for bracket notation (a[]=1\u0026a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations.\n\nNote: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.\n\nDetails\n\nThe arrayLimit option only checked limits for indexed notation (a[0]=1\u0026a[1]=2) but did not enforce it for bracket notation (a[]=1\u0026a[]=2).\n\nVulnerable code (lib/parse.js:159-162):\n\nif (root === '[]' \u0026\u0026 options.parseArrays) {\n    obj = utils.combine([], leaf);  // No arrayLimit check\n}\n\n\n\n\n\nWorking code (lib/parse.js:175):\n\nelse if (index \u003c= options.arrayLimit) {  // Limit checked here\n    obj = [];\n    obj[index] = leaf;\n}\n\n\n\n\n\nThe bracket notation handler at line 159 uses utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175 checks index \u003c= options.arrayLimit before creating arrays.\n\n\n\nPoC\n\nconst qs = require('qs');\nconst result = qs.parse('a[]=1\u0026a[]=2\u0026a[]=3\u0026a[]=4\u0026a[]=5\u0026a[]=6', { arrayLimit: 5 });\nconsole.log(result.a.length);  // Output: 6 (should be max 5)\n\n\n\n\n\nNote on parameterLimit interaction: The original advisory's \"DoS demonstration\" claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.\n\nImpact\n\nConsistency bug in arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit is explicitly set to a very high value.","status":"published","published":"2025-12-29T23:15:42Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:24.309973Z"},{"id":"AZL-73353","title":"CVE-2025-15284 affecting package js-jquery 3.5.0-4","description":"Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: \u003c 6.14.1.\n\n\nSummary\n\nThe arrayLimit option in qs did not enforce limits for bracket notation (a[]=1\u0026a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations.\n\nNote: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.\n\nDetails\n\nThe arrayLimit option only checked limits for indexed notation (a[0]=1\u0026a[1]=2) but did not enforce it for bracket notation (a[]=1\u0026a[]=2).\n\nVulnerable code (lib/parse.js:159-162):\n\nif (root === '[]' \u0026\u0026 options.parseArrays) {\n    obj = utils.combine([], leaf);  // No arrayLimit check\n}\n\n\n\n\n\nWorking code (lib/parse.js:175):\n\nelse if (index \u003c= options.arrayLimit) {  // Limit checked here\n    obj = [];\n    obj[index] = leaf;\n}\n\n\n\n\n\nThe bracket notation handler at line 159 uses utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175 checks index \u003c= options.arrayLimit before creating arrays.\n\n\n\nPoC\n\nconst qs = require('qs');\nconst result = qs.parse('a[]=1\u0026a[]=2\u0026a[]=3\u0026a[]=4\u0026a[]=5\u0026a[]=6', { arrayLimit: 5 });\nconsole.log(result.a.length);  // Output: 6 (should be max 5)\n\n\n\n\n\nNote on parameterLimit interaction: The original advisory's \"DoS demonstration\" claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.\n\nImpact\n\nConsistency bug in arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit is explicitly set to a very high value.","status":"published","published":"2025-12-29T23:15:42Z","modified":"2026-04-21T04:33:52.00396Z","updated_at":"2026-11-02T15:28:09.201912Z"},{"id":"AZL-73359","title":"CVE-2025-15284 affecting package nodejs-nodemon 2.0.3-4","description":"Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: \u003c 6.14.1.\n\n\nSummary\n\nThe arrayLimit option in qs did not enforce limits for bracket notation (a[]=1\u0026a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations.\n\nNote: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.\n\nDetails\n\nThe arrayLimit option only checked limits for indexed notation (a[0]=1\u0026a[1]=2) but did not enforce it for bracket notation (a[]=1\u0026a[]=2).\n\nVulnerable code (lib/parse.js:159-162):\n\nif (root === '[]' \u0026\u0026 options.parseArrays) {\n    obj = utils.combine([], leaf);  // No arrayLimit check\n}\n\n\n\n\n\nWorking code (lib/parse.js:175):\n\nelse if (index \u003c= options.arrayLimit) {  // Limit checked here\n    obj = [];\n    obj[index] = leaf;\n}\n\n\n\n\n\nThe bracket notation handler at line 159 uses utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175 checks index \u003c= options.arrayLimit before creating arrays.\n\n\n\nPoC\n\nconst qs = require('qs');\nconst result = qs.parse('a[]=1\u0026a[]=2\u0026a[]=3\u0026a[]=4\u0026a[]=5\u0026a[]=6', { arrayLimit: 5 });\nconsole.log(result.a.length);  // Output: 6 (should be max 5)\n\n\n\n\n\nNote on parameterLimit interaction: The original advisory's \"DoS demonstration\" claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.\n\nImpact\n\nConsistency bug in arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit is explicitly set to a very high value.","status":"published","published":"2025-12-29T23:15:42Z","modified":"2026-04-21T04:33:51.893679Z","updated_at":"2026-11-02T15:28:09.201912Z"},{"id":"CLSA-2026-1773101688","title":"TuxCare security update for qs (3 CVEs)","description":"TuxCare rebuilt qs to address 3 CVEs. Fixed in 5.2.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:11Z","modified":"2026-10-15T09:45:42.701636071Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1773101691","title":"TuxCare security update for qs (3 CVEs)","description":"TuxCare rebuilt qs to address 3 CVEs. Fixed in 5.1.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:11Z","modified":"2026-10-15T09:45:26.572797183Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1773274548","title":"TuxCare security update for qs (1 CVE)","description":"TuxCare rebuilt qs to address 1 CVE. Fixed in 6.5.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:28.460083396Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773274550","title":"TuxCare security update for qs (3 CVEs)","description":"TuxCare rebuilt qs to address 3 CVEs. Fixed in 2.3.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:28.76639633Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1776299673","title":"TuxCare security update for qs (1 CVE)","description":"TuxCare rebuilt qs to address 1 CVE. Fixed in 6.5.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:26Z","modified":"2026-10-15T09:47:49.817322145Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1784509773","title":"TuxCare security update for qs (2 CVEs)","description":"TuxCare rebuilt qs to address 2 CVEs. Fixed in 5.2.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:44Z","modified":"2026-10-15T09:45:58.786568003Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1784683089","title":"TuxCare security update for qs (2 CVEs)","description":"TuxCare rebuilt qs to address 2 CVEs. Fixed in 6.10.7-tuxcare.1.","status":"published","published":"2026-08-04T14:52:47Z","modified":"2026-10-15T09:47:54.181869777Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784769524","title":"TuxCare security update for qs (2 CVEs)","description":"TuxCare rebuilt qs to address 2 CVEs. Fixed in 6.10.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:47Z","modified":"2026-10-15T09:47:36.830204869Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784769609","title":"TuxCare security update for qs (3 CVEs)","description":"TuxCare rebuilt qs to address 3 CVEs. Fixed in 6.7.0-tuxcare.2.","status":"published","published":"2026-08-04T14:52:48Z","modified":"2026-10-15T09:47:36.457563414Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1790521454","title":"TuxCare security update for qs (2 CVEs)","description":"TuxCare rebuilt qs to address 2 CVEs. Fixed in 6.13.0-tuxcare.1.","status":"published","published":"2026-09-27T15:04:14Z","modified":"2026-10-15T09:47:38.295102338Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791373797","title":"TuxCare security update for qs (5 CVEs)","description":"TuxCare rebuilt qs to address 5 CVEs. Fixed in 0.6.5-tuxcare.1.","status":"published","published":"2026-10-07T11:49:57Z","modified":"2026-10-15T09:47:39.392238291Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791626635","title":"TuxCare security update for qs (1 CVE)","description":"TuxCare rebuilt qs to address 1 CVE. Fixed in 6.4.3-tuxcare.2.","status":"published","published":"2026-10-10T10:03:55Z","modified":"2026-10-15T09:48:04.615026121Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791806891","title":"TuxCare security update for qs (1 CVE)","description":"TuxCare rebuilt qs to address 1 CVE. Fixed in 6.2.6-tuxcare.2.","status":"published","published":"2026-10-12T12:08:11Z","modified":"2026-10-15T09:47:58.571477987Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792160905","title":"TuxCare security update for qs (1 CVE)","description":"TuxCare rebuilt qs to address 1 CVE. Fixed in 1.0.2-tuxcare.1.","status":"published","published":"2026-10-16T14:28:25Z","modified":"2026-10-16T16:30:45.077758884Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792164286","title":"TuxCare security update for qs (3 CVEs)","description":"TuxCare rebuilt qs to address 3 CVEs. Fixed in 6.11.2-tuxcare.1.","status":"published","published":"2026-10-16T15:24:46Z","modified":"2026-10-16T16:32:00.365310405Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792164375","title":"TuxCare security update for qs (2 CVEs)","description":"TuxCare rebuilt qs to address 2 CVEs. Fixed in 6.10.4-tuxcare.1.","status":"published","published":"2026-10-16T15:26:15Z","modified":"2026-10-16T16:30:46.822835709Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792447268","title":"TuxCare security update for qs (3 CVEs)","description":"TuxCare rebuilt qs to address 3 CVEs. Fixed in 6.5.1-tuxcare.1.","status":"published","published":"2026-10-19T22:01:08Z","modified":"2026-10-20T01:45:09.149779634Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792476180","title":"TuxCare security update for qs (4 CVEs)","description":"TuxCare rebuilt qs to address 4 CVEs. Fixed in 6.2.1-tuxcare.1.","status":"published","published":"2026-10-20T06:03:00Z","modified":"2026-10-20T07:15:09.283036707Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792763694","title":"TuxCare security update for qs (2 CVEs)","description":"TuxCare rebuilt qs to address 2 CVEs. Fixed in 6.5.3-tuxcare.2.","status":"published","published":"2026-10-23T13:54:54Z","modified":"2026-10-23T19:15:10.361426453Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1793015893","title":"TuxCare security update for qs (5 CVEs)","description":"TuxCare rebuilt qs to address 5 CVEs. Fixed in 0.4.2-tuxcare.1.","status":"published","published":"2026-10-26T11:58:13Z","modified":"2026-10-26T13:30:02.537397809Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1793867524","title":"TuxCare security update for qs (1 CVE)","description":"TuxCare rebuilt qs to address 1 CVE. Fixed in 6.14.0-tuxcare.6.","status":"published","published":"2026-11-05T09:32:05Z","modified":"2026-11-05T13:15:12.588724268Z","updated_at":"2026-11-05T13:30:00.949926Z"}]}}