Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
ljharb/qs
main @ 18d085e
12
Fixes
5
CVEs
HIGH
Peak severity
60.0%
Coverage
Highlights
Denial of Service: 8 prior fixes. Scrutinize any change in this area.
lib/parse.js: most-fixed (5 issues). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Denial of Service: Attackers can bypass the configured `arrayLimit` constraint by using comma-separated values, empty-bracket notation, or cumulative duplicate keys, allocating massive arrays that exhaust system memory. This pattern is tracked across multiple fixes and CVE-2026-2391/CVE-2025-15284.
Prototype Pollution: Parsing malicious query strings containing '__proto__' keys or manipulating prototype properties allows attackers to alter global object properties, potentially leading to remote code execution or application crashes (CVE-2022-24999). Direct assignment and prototype method calls on untrusted structures must be avoided.
Denial of Service: Algorithmic complexity vulnerabilities, specifically O(N^2) behavior in utility routines like array compaction, allow attackers to exhaust CPU resources using relatively small, crafted payloads.