[GHSA] GHSA-x5fp-wj9c-mxmx (medium) — qs array-limit bypass via bracket-key comma parsing

GHSA-x5fp-wj9c-mxmx Severity: medium CVE: CVE-2026-82562

qs array-limit bypass via bracket-key comma parsing

### Summary

`qs` `v6.15.3` allows bracket-key input to bypass `arrayLimit` and `throwOnLimitExceeded` when `comma: true`. The input `a[]=1,2,3,4` succeeds with `arrayLimit: 3`, while the equivalent plain-key input is rejected.

Affected version tested:

```text qs v6.15.3 commit 18d085e9