Death by a Thousand Commas: Deep Dive into CVE-2026-2391
Vulnerability ID: CVE-2026-2391
CVSS Score: 6.3
Published: 2026-02-12
A logic flaw in the popular Node.js qs library allows attackers to bypass array limits when the comma parsing option is enabled. By sending a crafted query string containing thousands of commas, an unauthenticated attacker can force the application to allocate massive arrays, leading to memory exhaustion and a Denial of Service (DoS). This vulnerability highlights the dangers of 'return early' patterns in input validation logic.
TL;DR
The qs library (used by Express.js) ignores arrayLimit when parsing comma-separated values (?a=1,2,3...). Attackers can trigger OOM crashes by sending massive comma strings. Fixed in 6.14.2.
⚠️ Exploit Status: POC
Technical Details
- CWE: CWE-20 / CWE-770
- CVSS v4.0: 6.3 (Medium)
- Attack Vector: Network (Remote)
- Privileges: None
- Impact: Denial of Service (Memory Exhaustion)
- EPSS Score: 0.00049 (~0.05%)
Affected Systems
- Node.js applications using
qs - Express.js applications (if using
qswith custom configuration) - APIs parsing CSV-style query parameters
-
qs: <= 6.14.1 (Fixed in:
6.14.2)
Code Analysis
Commit: f6a7abf
Fix: ensure comma: true respects arrayLimit
diff --git a/lib/parse.js b/lib/parse.js
index ...
--- a/lib/parse.js
+++ b/lib/parse.js
@@ -40,7 +40,11 @@
- return val.split(',');
+ var values = val.split(',');
+ if (values.length > options.arrayLimit) {
+ // enforcement logic
+ }
+ return values;
Exploit Details
- Internal Research: PoC demonstrating memory spike with comma-separated values
Mitigation Strategies
- Upgrade qs library to version 6.14.2+
- Disable 'comma' parsing option if not strictly required
- Implement WAF rules to limit query string length
- Implement strict input validation on parameter length before parsing
Remediation Steps:
- Check current version:
npm list qs - Update package:
npm install qs@latest - Audit code for usages of
qs.parse(str, { comma: true }) - Verify fix by running the PoC script against the new version
References
Read the full report for CVE-2026-2391 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)