CVE-2025-15284: Qs_project Qs HTTP DoS Vulnerability

CVE-2025-15284 Overview

CVE-2025-15284 is an improper input validation vulnerability [CWE-20] in the qs query string parsing library for Node.js. The flaw affects versions prior to 6.14.1 and stems from inconsistent enforcement of the arrayLimit option across array notations. While indexed notation (a[0]=1) correctly honors the configured limit, bracket notation (a[]=1&a[]=2) bypasses it entirely. This inconsistency can enable HTTP-based denial of service (DoS) in applications that raise the default parameterLimit of 1000.

Critical Impact
Applications parsing untrusted query strings with qs can allocate arrays larger than the configured arrayLimit, leading to resource consumption when parameterLimit is set to a high value.

Affected Products

qs (qs_project) versions prior to 6.14.1
Node.js applications and frameworks bundling vulnerable qs releases
HTTP servers using qs to parse query strings or request bodies

Discovery Timeline

2025-12-29 - CVE CVE-2025-15284 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-15284

Vulnerability Analysis

The qs library exposes an arrayLimit option that caps the maximum number of elements a parsed array can hold. The parser applies this limit inconsistently. Indexed notation (a[0]=1&a[1]=2) validates each index against arrayLimit before array creation. Bracket notation (a[]=1&a[]=2) skips this check and invokes utils.combine([], leaf) directly, allowing arrays of arbitrary length up to the parameterLimit.

The practical impact depends on configuration. With the default parameterLimit of 1000, bracket notation cannot produce arrays larger than 1000 entries because each a[]=value consumes one parameter slot. Applications that explicitly raise parameterLimit to accept larger payloads inherit the DoS exposure, since arrayLimit no longer constrains bracket-notation growth.

Root Cause

The root cause lies in lib/parse.js at line 159, where the bracket notation branch creates arrays without consulting options.arrayLimit. The indexed notation branch at line 175 performs the correct index <= options.arrayLimit check. This asymmetric handling violates the principle that a single configuration option should govern all equivalent notations.

Attack Vector

An unauthenticated remote attacker submits an HTTP request containing a query string or body with many repeated bracket-notation parameters, such as a[]=1&a[]=2&.... If the target application uses qs with a raised parameterLimit, the resulting array grows without bound up to parameterLimit, consuming memory and CPU during parsing.

javascript

// Proof-of-concept demonstrating the arrayLimit bypass
const qs = require('qs');
const result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5 });
console.log(result.a.length);  // Output: 6 (should be capped at 5)

The upstream fix in lib/parse.js passes arrayLimit through to utils.combine so bracket notation honors the same cap:

javascript

 if (key !== null) {
     var existing = has.call(obj, key);
     if (existing && options.duplicates === 'combine') {
-        obj[key] = utils.combine(obj[key], val);
+        obj[key] = utils.combine(
+            obj[key],
+            val,
+            options.arrayLimit,
+            options.plainObjects
+        );
     } else if (!existing || options.duplicates === 'last') {
         obj[key] = val;
     }

Source: GitHub commit 3086902

Detection Methods for CVE-2025-15284

Indicators of Compromise

HTTP requests containing large numbers of repeated bracket-notation query parameters (e.g., a[]= repeated hundreds or thousands of times)
Node.js process memory spikes correlated with inbound request parsing
Elevated event-loop latency or increased 5xx error rates during query-string parsing

Detection Strategies

Inventory Node.js applications and dependencies for qs versions below 6.14.1 using npm ls qs or software composition analysis tooling
Audit application code for explicit parameterLimit overrides that raise the value above the default of 1000
Inspect web server and reverse proxy logs for query strings containing high-frequency bracket-notation parameters

Monitoring Recommendations

Track memory and CPU utilization of Node.js worker processes and alert on sustained anomalies during request parsing
Enable request-body and query-string length limits at the reverse proxy or web application firewall
Log and rate-limit clients sending unusually large or repetitive parameter payloads

How to Mitigate CVE-2025-15284

Immediate Actions Required

Upgrade qs to version 6.14.1 or later across all Node.js services and transitive dependencies
Review application configuration and remove or lower any explicit parameterLimit overrides that exceed the default of 1000
Enforce request size and parameter count limits at the ingress layer (reverse proxy, API gateway, or WAF)

Patch Information

The fix is delivered in qs version 6.14.1. The patch in commit 3086902 passes options.arrayLimit to utils.combine and adds a side-channel mechanism in lib/utils.js to track objects that overflow the array limit. Details are documented in the GitHub Security Advisory GHSA-6rw7-vpxm-498p.

Workarounds

Retain the default parameterLimit of 1000 to constrain bracket-notation array growth until the patched version is deployed
Reject or truncate query strings above a defined byte length at the reverse proxy or load balancer
Where possible, disable array parsing by setting parseArrays: false in the qs.parse options

bash

# Update qs to the patched release
npm install qs@^6.14.1

# Verify the resolved version tree
npm ls qs