THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-82562 (LOW 3.7) — ### Summary When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`),

[NVD] CVE-2026-82562 (LOW 3.7) — ### Summary When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`),

mednvdPublished 2026-08-30

CVE-2026-82562 CVSS: 3.7 LOW Published: 2026-08-30T01:20:32.820

### Summary

When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a

Indicators of compromise

CVE-2026-82562cve
CVE-2026-2391cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-82562