{"action":"Upgrade qs to 6.16.0 or later.","affected":[{"fixed":"6.16.0","introduced":"6.14.2"}],"component":"qs","cve_ids":["CVE-2026-82562"],"ecosystem":"npm","epss":0.0054,"exploited":false,"fixed_versions":["6.16.0"],"ghsa_id":"GHSA-x5fp-wj9c-mxmx","id":"tcs_01M5KGH0V0JR0Q0CJ3V26C6NAD","modified_at":"2026-09-10T03:50:54.569331980Z","published_at":"2026-09-02T14:46:57Z","references":["https://osv.dev/vulnerability/GHSA-x5fp-wj9c-mxmx","https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx","https://nvd.nist.gov/vuln/detail/CVE-2026-82562","https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464","https://github.com/ljharb/qs"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"GHSA-x5fp-wj9c-mxmx","url":"https://osv.dev/vulnerability/GHSA-x5fp-wj9c-mxmx"}],"summary":"qs array-limit bypass via bracket-key comma parsing"}