CVE-2026-2391 qs's arrayLimit bypass in comma parsing allows denial of service

🗓️ 12 Feb 2026 04:39:42Reported by harboristType

CVE-2026-2391: qs comma parsing bypasses arrayLimit, causing memory exhaustion denial of service.

Reporter	Title	Published	Views	Family All 86
IBM Security Bulletins	Security Bulletin: DevOps Test Performance contains a vulnerabilty related to use of the qs library	7 Apr 202615:44	–	ibm
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software	22 Jun 202614:27	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Edge Application Manager	17 Mar 202603:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Datapower Operations Dashboard is vulnerable to Allocation of Resources Without Limits CVE-2025-15284	8 Jun 202613:54	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to vulnerability in qs	29 Jun 202613:43	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in the qs package affects IBM® Db2® Big SQL on IBM Cloud Pak for Data.	15 May 202614:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Endpoint Management is affected by multiple vulnerabilities	30 Jun 202612:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Streams is affected by multiple vulnerabilities	30 Jun 202612:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Processing is affected by Multiple vulnerabilities	12 Jun 202607:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to multiple CVEs.	30 Apr 202611:40	–	ibm

[
  {
    "collectionURL": "https://npmjs.com/qs",
    "defaultStatus": "unaffected",
    "packageName": "qs",
    "repo": "https://github.com/ljharb/qs",
    "versions": [
      {
        "lessThanOrEqual": "6.14.1",
        "status": "affected",
        "version": "6.7.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
github	www.github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482
github	www.github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883

12 Feb 2026 17:32Current

CVSS 3.13.7

CVSS 46.3

EPSS0.00478

CWE-20