CVE-2025-15284
Improper Input Validation in qs Parse Module Causes HTTP DoS
Publication date: 2025-12-29
Last updated on: 2026-02-26
Assigner: harborist
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| qs_project | qs | to 6.14.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an improper input validation issue in the 'qs' library's parse modules, specifically affecting versions before 6.14.1. The 'arrayLimit' option is intended to limit the number of array elements parsed from query strings. However, it only enforces limits for indexed notation (e.g., a[0]=1) and completely bypasses limits for bracket notation (e.g., a[]=1&a[]=2). This allows attackers to send HTTP requests with many bracket notation parameters, causing the parser to create very large arrays without limit checks, leading to memory exhaustion and denial of service.
How can this vulnerability impact me? :
The vulnerability can cause denial of service (DoS) by exhausting server memory. An attacker can send a single HTTP request with a very large number of parameters using bracket notation, bypassing the 'arrayLimit' protection. This causes the server to allocate excessive memory, potentially crashing the application or making it unresponsive, resulting in service unavailability for all users. No authentication is required, and the attack is easy to automate and scale, affecting any endpoint parsing query strings with bracket notation.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the qs.parse() function with bracket notation query strings that exceed the configured arrayLimit. For example, you can run Node.js commands to parse a query string with multiple bracket notation parameters and check if the resulting array length exceeds the arrayLimit setting, indicating the vulnerability. Example commands: const qs = require('qs'); const result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5 }); console.log(result.a.length); // Output: 6 (should be max 5) Or for a larger test: const attack = 'a[]=' + Array(10000).fill('x').join('&a[]='); const result = qs.parse(attack, { arrayLimit: 100 }); console.log(result.a.length); // Output: 10000 (should be max 100) If the output array length exceeds the arrayLimit, the system is vulnerable.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding the use of qs versions below 6.14.1, as the vulnerability affects qs versions less than 6.14.1. Additionally, do not rely solely on the arrayLimit option for DoS protection when using bracket notation, since it does not enforce limits properly. Consider updating the qs library to version 6.14.1 or later where this issue is fixed. Also, implement additional input validation or rate limiting on incoming HTTP requests to prevent excessive memory consumption from large arrays in query strings.