CVE-2026-82562
1 advisory.
npm/qs CVE-2026-82562: low 3.7, EPSS 0.54%
qs array-limit bypass via bracket-key comma parsing
Action: Upgrade qs to 6.16.0 or later.
npm i qs@6.16.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.14.2 | 6.16.0 | - |
Fixed versions
| 6.16.0 |
Sources
- osv: GHSA-x5fp-wj9c-mxmx
- https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883
- https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx
- https://nvd.nist.gov/vuln/detail/CVE-2026-82562
- https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464
- https://github.com/ljharb/qs
CVE-2026-82562 · published · modified · JSON