CVE-2026-2391
📋 TL;DR
This vulnerability in the qs library allows attackers to bypass array size limits when comma-separated parsing is enabled, creating arbitrarily large arrays that can exhaust server memory. Applications using qs with the 'comma: true' configuration option are affected. This can lead to denial-of-service attacks through memory exhaustion.
💻 Affected Systems
- qs library
📦 What is this software?
Qs by Qs Project
⚠️ Risk & Real-World Impact
Worst Case
Complete server unavailability due to memory exhaustion, requiring restart and potentially causing extended downtime.
Likely Case
Degraded performance or temporary service disruption as servers handle memory-intensive parsing requests.
If Mitigated
Minimal impact with proper input validation and rate limiting in place.
🎯 Exploit Status
Proof of concept code is publicly available in the advisory
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version with commit f6a7abff1f13d644db9b05fe4f2c98ada6bf8482
Vendor Advisory: https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883
Restart Required: No
Instructions:
1. Update qs package to patched version. 2. Run 'npm update qs' or 'yarn upgrade qs'. 3. Verify the fix by testing with the PoC.
🔧 Temporary Workarounds
Disable comma parsing
allSet 'comma: false' in qs configuration to disable vulnerable parsing mode
const options = { comma: false };
Input validation
allImplement request size limits and validate parameter values before parsing
🧯 If You Can't Patch
- Disable comma parsing by setting comma: false in all qs configurations
- Implement WAF rules to block requests with excessive commas in query parameters
🔍 How to Verify
Check if Vulnerable:
Test with the provided PoC code using your application's qs configurationCheck Version:
npm list qs or check package.json for qs versionVerify Fix Applied:
Run the PoC test after patching - it should now throw 'Array limit exceeded' error📡 Detection & Monitoring
Log Indicators:
- Unusually large memory usage spikes
- Process crashes or restarts
- Slow response times during parsing
Network Indicators:
- Requests with query parameters containing hundreds or thousands of commas
- Repeated requests with comma-heavy parameters
SIEM Query:
search query_parameters contains "," count > 100