qsのbracket表記におけるarrayLimitバイパスにより、メモリ枯渇を伴うDoS攻撃が可能

The vulnerability lies in the qs package's handling of array parameters in URL query strings. Specifically, the arrayLimit option, intended to restrict the size of arrays parsed from query parameters, was not consistently applied to both indexed (a[0]=1) and bracket (a[]=1&a[]=2) notations. While the default parameterLimit of 1000 effectively limits the overall number of parameters, an attacker could theoretically craft a malicious query string exploiting this inconsistency to consume excessive server resources, leading to a denial of service. The impact is reduced by the default parameter limit, but applications relying on stricter array size controls are more vulnerable.

Applications built with Node.js that utilize the qs package for parsing URL query strings are at risk. This includes web applications, APIs, and backend services that rely on qs for request processing. Specifically, applications that have explicitly disabled or modified the default parameterLimit are more vulnerable.

• nodejs / server:

  npm list qs

This command will list the installed version of the qs package. Compare the version with the affected range (prior to 6.14.1). • nodejs / server:

npm audit qs --audit-level=high

This command will check for known vulnerabilities in the qs package and suggest remediation steps. • generic web: Review application logs for unusually large or complex query strings, particularly those utilizing bracket notation for array parameters. Look for patterns that might indicate an attempt to exploit the inconsistent array limit handling.

1. 2025-12-30Disclosure

   disclosure

1. 予約済み2025-12-29
2. 公開日2025-12-30
3. 更新日2026-03-04
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2025-15284 is to upgrade the qs package to version 6.14.1 or later. This version includes the corrected handling of array limits. If upgrading is not immediately feasible, consider implementing stricter parameter limits within your application code to prevent excessive query string sizes. Additionally, configure your web server or reverse proxy to enforce request size limits, further reducing the potential for resource exhaustion. No specific Sigma or YARA rules are readily available for this vulnerability.

最終更新

6.15.2最近