1 matches found
qs array-limit bypass via bracket-key comma parsing
Summary qs v6.15.3 allows bracket-key input to bypass arrayLimit and throwOnLimitExceeded when comma: true. The input a=1,2,3,4 succeeds with arrayLimit: 3, while the equivalent plain-key input is rejected. Affected version tested: text qs v6.15.3 commit 18d085e919dae70c8f1b200ab99323058edab2c2...
6.3CVSS5.8AI score0.0054EPSS
SaveExploits0References5Affected Software1
20