CVE-2026-2391

What it actually does

The flaw is a denial-of-service condition in the Node.js `qs` query-string parser when applications enable the non-default `comma: true` option. In that mode, comma-separated parameter values are split into arrays before `arrayLimit` and `throwOnLimitExceeded` checks are applied. As a result, a single query parameter containing a very large number of commas can cause `qs.parse()` to allocate an extremely large array, consuming process memory and potentially crashing the Node.js runtime or the hosting service.

Why it matters to the business

Successful exploitation can make affected web applications or APIs slow, unstable, or unavailable by exhausting server memory. The risk is most relevant for internet-facing Node.js services that parse attacker-controlled query strings with `qs` and explicitly enable comma parsing. The CVSS and EPSS values indicate relatively low current exploitation likelihood, it is not in CISA KEV, and no ransomware use is reported, but the issue has been public for 178 days and can still affect availability if exposed endpoints accept large query strings.

How an attack unfolds

An attacker identifies an endpoint backed by a Node.js application or framework path that uses `qs.parse()` with `comma: true`. The attacker sends HTTP requests containing one or more query parameters with very long comma-separated values, such as a parameter whose value is mostly repeated commas. Because the vulnerable parser splits the value into an array before enforcing `arrayLimit`, the application allocates memory proportional to the number of comma-separated elements instead of rejecting the input. Repeated or oversized requests can drive high memory use, garbage-collection pressure, process crashes, container restarts, or service-level outages. No authentication or user interaction is required if the vulnerable parsing path is reachable over the network.

How to fix it

Upgrade `ljharb/qs` to a version that includes commit `f6a7abff1f13d644db9b05fe4f2c98ada6bf8482`, or pin directly to that fixed commit where consuming from Git. Deduplicate and update all transitive copies through package-lock, yarn.lock, pnpm-lock.yaml, or equivalent lockfiles. If immediate upgrade is not possible, disable `comma: true` where not strictly required, enforce maximum request-line and query-string sizes at the reverse proxy or application layer, reject parameters with excessive comma counts, set conservative body/query parser limits, and ensure process supervisors impose memory limits with graceful restart behavior. Treat mitigation as defense in depth; the preferred fix is to consume a patched `qs` release or the fixed commit.

How to confirm the fix worked

Confirm exposure by inventorying applications and lockfiles for the `qs` package and verifying whether any code path calls `qs.parse()` or a framework wrapper with `comma: true`. Confirm remediation by checking that the resolved dependency contains commit `f6a7abff1f13d644db9b05fe4f2c98ada6bf8482` or a later release that includes it. In a non-production environment, parse a parameter with more comma-separated elements than the configured `arrayLimit` while `throwOnLimitExceeded` is enabled and verify that the parser enforces the limit rather than returning an oversized array. Also validate that edge controls reject oversized query strings and that SCA/dependency scanning no longer reports the vulnerable `qs` version.

Typical attack path

1. Find a web application or API endpoint that accepts query-string parameters.
2. Determine or assume that the backend uses the `qs` package with `comma: true` enabled.
3. Send a request containing a query parameter with an unusually large number of comma-separated empty or short values.
4. Trigger `qs.parse()` to call `split(',')` and allocate an oversized array before `arrayLimit` is enforced.
5. Repeat or enlarge requests until Node.js memory usage spikes, garbage collection stalls, or the process crashes.
6. Cause user-visible errors, restarts, degraded performance, or temporary service unavailability.

How to detect it

To determine whether exploitation already occurred, review HTTP access logs, CDN/WAF logs, reverse proxy logs, and application request logs for unusually long query strings containing high counts of commas in a single parameter value. Correlate those requests with spikes in Node.js heap usage, garbage-collection pauses, HTTP 500/502/503/504 responses, request timeouts, container OOM kills, systemd or PM2 restarts, Kubernetes pod restarts, and V8 fatal memory errors. In application logs, look for crashes or restarts immediately after requests with comma-dense query parameters. In infrastructure telemetry, review memory metrics and restart events for Node.js services around the same timestamps. If available, preserve suspicious request samples, source IPs, user agents, and heap or crash dumps for scoping, but avoid replaying large payloads against production systems.

• FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory
• FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory
• JavaScript heap out of memory
• Allocation failed - JavaScript heap out of memory
• signal: killed
• OOMKilled
• ExitCode:137
• exit code 137
• ENOMEM
• qs.parse
• comma: true
• ?,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
• =,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
• HTTP 414
• Request-URI Too Large
• Request Header Or Cookie Too Large

What your security team should do

• Prioritize internet-facing Node.js services and APIs that parse query strings with `qs` and may enable `comma: true`.
• Upgrade or pin `qs` to a build containing commit `f6a7abff1f13d644db9b05fe4f2c98ada6bf8482`, then rebuild and redeploy affected services.
• Regenerate lockfiles and container images to eliminate stale or transitive vulnerable copies of `qs`.
• Add reverse proxy, load balancer, or application rules limiting maximum URL/query-string length and rejecting query parameters with excessive comma density.
• Review application code for unnecessary `comma: true` usage and disable it unless required by a documented API contract.
• Monitor for Node.js memory exhaustion, process restarts, and anomalously long comma-heavy query strings, especially on public endpoints.
• Because this is not KEV-listed and has low EPSS, handle as availability-hardening work unless exposure is confirmed on critical public services, in which case patch promptly.