CVE-2025-15284
📋 TL;DR
This vulnerability allows attackers to bypass array size limits in the qs parsing library, enabling denial-of-service attacks via memory exhaustion. Applications using qs.parse() with user-controlled input and arrayLimit configuration for protection are affected.
💻 Affected Systems
- qs (npm package)
📦 What is this software?
Qs by Qs Project
⚠️ Risk & Real-World Impact
Worst Case
Single malicious HTTP request with thousands of bracket notation parameters can exhaust server memory, causing application crashes and service unavailability for all users.
Likely Case
Attackers can easily craft requests to bypass array limits, causing resource exhaustion and degraded performance on vulnerable endpoints.
If Mitigated
With proper input validation and rate limiting, impact is limited to potential performance degradation rather than complete service outage.
🎯 Exploit Status
Simple HTTP request construction required, no authentication needed
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.14.1
Vendor Advisory: https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p
Restart Required: No
Instructions:
Update qs package: npm update qs
Verify version: npm list qs
Test with provided PoC to confirm fix
🔧 Temporary Workarounds
Input validation wrapper
allImplement custom input validation before qs.parse to limit array sizes
// JavaScript example: const MAX_ARRAY_SIZE = 100;
// Validate query string before parsing
🧯 If You Can't Patch
- Implement rate limiting on endpoints parsing query strings
- Deploy WAF rules to block requests with excessive bracket notation parameters
🔍 How to Verify
Check if Vulnerable:
Test with provided PoC: const qs = require('qs'); const result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5 }); console.log(result.a.length); // Vulnerable if output > 5Check Version:
npm list qs | grep qsVerify Fix Applied:
Run same test after update; output should be 5 (limited by arrayLimit)📡 Detection & Monitoring
Log Indicators:
- HTTP requests with excessive bracket notation parameters (a[]=value repeated)
- Unusual memory spikes during query string parsing
Network Indicators:
- High volume of requests with bracket notation patterns
- Requests with thousands of a[] parameters
SIEM Query:
source=web_logs AND uri_query CONTAINS "[]=" AND uri_query COUNT("[]=") > 100