UpHeron
All vulnerabilities

npm

CVE-2026-2391

qs's arrayLimit bypass in comma parsing allows denial of service

Severity
Low 3.7
Published
12 Feb 2026
Last changed
10 Sept 2026
Added to UpHeron
22 Oct 2026
Fixed in
6.14.2
Also known as
GHSA-w7fw-mjwx-w883
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
qsnpm · osv:npm:qs
  • From 6.7.0 before 6.14.2

References