UpHeron
All vulnerabilities

npm

CVE-2025-15284

qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion

Severity
Medium 3.7
Published
30 Dec 2025
Last changed
10 Sept 2026
Added to UpHeron
22 Oct 2026
Fixed in
6.14.1
Also known as
GHSA-6rw7-vpxm-498p
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
qsnpm · osv:npm:qs
  • Every version before 6.14.1

References