GHSA-6rw7-vpxm-498p
Low · 3.7CVSS
3.7
EPSS
—
Published
Dec 30, 2025
CISA due date
—
The record
qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | qs | 0 | 6.14.1 |
| Chainguard | arangodb-3.11 | 0 | 3.11.14.2-r3 |
| Chainguard | arangodb-3.11-compat | 0 | 3.11.14.2-r3 |
| Chainguard | arangodb-3.12 | 0 | 3.12.7.1-r1 |
| Chainguard | arangodb-3.12-compat | 0 | 3.12.7.1-r1 |
| Chainguard | argo-workflow-cli-3.6 | 0 | 3.6.15-r1 |
| Chainguard | argo-workflow-cli-3.7 | 0 | 3.7.6-r1 |
| Chainguard | argo-workflow-controller-3.6 | 0 | 3.6.15-r1 |
| Chainguard | argo-workflow-controller-3.6-compat | 0 | 3.6.15-r1 |
| Chainguard | argo-workflow-controller-3.7 | 0 | 3.7.6-r1 |
| Chainguard | argo-workflow-controller-3.7-compat | 0 | 3.7.6-r1 |
| Chainguard | argo-workflow-executor-3.6 | 0 | 3.6.15-r1 |
| Chainguard | argo-workflow-executor-3.6-compat | 0 | 3.6.15-r1 |
| Chainguard | argo-workflow-executor-3.7 | 0 | 3.7.6-r1 |
| Chainguard | argo-workflow-executor-3.7-compat | 0 | 3.7.6-r1 |
| Chainguard | argo-workflows-3.6 | 0 | 3.6.15-r1 |
| Chainguard | argo-workflows-3.7 | 0 | 3.7.6-r1 |
| Chainguard | argo-workflows-known-hosts-3.6 | 0 | 3.6.15-r1 |
| Chainguard | argo-workflows-known-hosts-3.7 | 0 | 3.7.6-r1 |
| Chainguard | argo-workflows-ui-3.6 | 0 | 3.6.16-r0 |
| Chainguard | argo-workflows-ui-3.7 | 0 | 3.7.7-r0 |
| Chainguard | code-server | 0 | 4.106.3-r1 |
| Chainguard | code-server-compat | 0 | 4.106.3-r1 |
| Chainguard | json-server | 0 | 0.17.4-r3 |
| Chainguard | kibana-9.1 | 0 | 9.1.9-r1 |
| Chainguard | kibana-9.1-bitnami | 0 | 9.1.9-r1 |
| Chainguard | kibana-9.1-iamguarded | 0 | 9.1.9-r1 |
| Chainguard | kibana-9.2 | 0 | 9.2.3-r1 |
| Chainguard | kibana-9.2-iamguarded | 0 | 9.2.3-r1 |
| Chainguard | kubeflow-centraldashboard | 0 | 1.10.0-r8 |
| Chainguard | kubeflow-pipelines | 0 | 2.15.0-r5 |
| Chainguard | kubeflow-pipelines-apiserver | 0 | 2.15.0-r5 |
| Chainguard | kubeflow-pipelines-cache-deployer | 0 | 2.15.0-r5 |
| Chainguard | kubeflow-pipelines-cache-deployer-compat | 0 | 2.15.0-r5 |
| Chainguard | kubeflow-pipelines-cache_server | 0 | 2.15.0-r5 |
| Chainguard | kubeflow-pipelines-frontend | 0 | 2.15.0-r12 |
| Chainguard | kubeflow-pipelines-metadata-envoy-config | 0 | 2.15.0-r5 |
| Chainguard | kubeflow-pipelines-metadata-writer | 0 | 2.15.0-r5 |
| Chainguard | kubeflow-pipelines-metadata-writer-compat | 0 | 2.15.0-r5 |
| Chainguard | kubeflow-pipelines-persistence_agent | 0 | 2.15.0-r5 |
| Chainguard | kubeflow-pipelines-scheduledworkflow | 0 | 2.15.0-r5 |
| Chainguard | kubeflow-pipelines-viewer-crd-controller | 0 | 2.15.0-r5 |
| Chainguard | langfuse-2 | 0 | 2.95.12-r4 |
| Chainguard | langfuse-2-compat | 0 | 2.95.12-r4 |
| Chainguard | langfuse-2-worker | 0 | 2.95.12-r4 |
| Chainguard | langfuse-3 | 0 | 3.143.0-r1 |
| Chainguard | langfuse-3-compat | 0 | 3.143.0-r1 |
| Chainguard | langfuse-3-worker | 0 | 3.143.0-r1 |
| Chainguard | langfuse-fips-2 | 0 | 2.95.12-r4 |
| Chainguard | langfuse-fips-2-compat | 0 | 2.95.12-r4 |
| Chainguard | langfuse-fips-2-worker | 0 | 2.95.12-r4 |
| Chainguard | langfuse-fips-3 | 0 | 3.144.0-r0 |
| Chainguard | langfuse-fips-3-compat | 0 | 3.143.0-r1 |
| Chainguard | langfuse-fips-3-worker | 0 | 3.143.0-r1 |
| Chainguard | langfuse-web-3 | 0 | 3.143.0-r1 |
| Chainguard | langfuse-web-compat | 0 | 3.143.0-r1 |
| Chainguard | langfuse-worker-3 | 0 | 3.143.0-r1 |
| Chainguard | librechat | 0 | 0.8.1-r2 |
| Chainguard | librechat-compat | 0 | 0.8.1-r2 |
| Chainguard | librechat-dev | 0 | 0.8.1-r2 |
| Chainguard | opensearch-dashboards-2 | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-alerting-dashboards-plugin | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-anomaly-detection-dashboards-plugin | 0 | 2.19.4-r5 |
| Chainguard | opensearch-dashboards-2-config | 0 | 2.19.4-r4 |
| Chainguard | opensearch-dashboards-2-dashboards-maps | 0 | 2.19.4-r5 |
| Chainguard | opensearch-dashboards-2-dashboards-notifications | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-dashboards-observability | 0 | 2.19.4-r15 |
| Chainguard | opensearch-dashboards-2-dashboards-query-workbench | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-dashboards-reporting | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-dashboards-search-relevance | 0 | 2.19.5-r4 |
| Chainguard | opensearch-dashboards-2-dashboards-visualizations | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-fips | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-fips-alerting-dashboards-plugin | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-fips-anomaly-detection-dashboards-plugin | 0 | 2.19.4-r5 |
| Chainguard | opensearch-dashboards-2-fips-config | 0 | 2.19.4-r4 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-maps | 0 | 2.19.4-r5 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-notifications | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-observability | 0 | 2.19.4-r11 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-query-workbench | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-reporting | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-search-relevance | 0 | 2.19.4-r11 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-visualizations | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-fips-index-management-dashboards-plugin | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-fips-ml-commons-dashboards | 0 | 2.19.4-r5 |
| Chainguard | opensearch-dashboards-2-fips-security-analytics-dashboards-plugin | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-fips-security-dashboards-plugin | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-index-management-dashboards-plugin | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-ml-commons-dashboards | 0 | 2.19.4-r5 |
| Chainguard | opensearch-dashboards-2-security-analytics-dashboards-plugin | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-2-security-dashboards-plugin | 0 | 2.19.4-r10 |
| Chainguard | opensearch-dashboards-3 | 0 | 3.5.0-r0 |
| Chainguard | opensearch-dashboards-3-alerting-dashboards-plugin | 0 | 3.5.0-r0 |
| Chainguard | opensearch-dashboards-3-anomaly-detection-dashboards-plugin | 0 | 3.4.0-r0 |
| Chainguard | opensearch-dashboards-3-config | 0 | 3.2.0-r2 |
| Chainguard | opensearch-dashboards-3-dashboards-maps | 0 | 3.4.0-r0 |
| Chainguard | opensearch-dashboards-3-dashboards-notifications | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-dashboards-observability | 0 | 3.5.0-r5 |
| Chainguard | opensearch-dashboards-3-dashboards-query-workbench | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-dashboards-reporting | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-dashboards-search-relevance | 0 | 3.5.0-r5 |
| Chainguard | opensearch-dashboards-3-fips | 0 | 3.5.0-r0 |
| Chainguard | opensearch-dashboards-3-fips-alerting-dashboards-plugin | 0 | 3.5.0-r0 |
| Chainguard | opensearch-dashboards-3-fips-anomaly-detection-dashboards-plugin | 0 | 3.4.0-r0 |
| Chainguard | opensearch-dashboards-3-fips-config | 0 | 3.2.0-r3 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-maps | 0 | 3.4.0-r0 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-notifications | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-observability | 0 | 3.5.0-r3 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-query-workbench | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-reporting | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-search-relevance | 0 | 3.5.0-r3 |
| Chainguard | opensearch-dashboards-3-fips-index-management-dashboards-plugin | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-fips-ml-commons-dashboards | 0 | 3.4.0-r0 |
| Chainguard | opensearch-dashboards-3-fips-security-analytics-dashboards-plugin | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-fips-security-dashboards-plugin | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-index-management-dashboards-plugin | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-ml-commons-dashboards | 0 | 3.4.0-r0 |
| Chainguard | opensearch-dashboards-3-security-analytics-dashboards-plugin | 0 | 3.5.0-r1 |
| Chainguard | opensearch-dashboards-3-security-dashboards-plugin | 0 | 3.5.0-r1 |
| Chainguard | redisinsight | 0 | 3.0.0-r1 |
| Chainguard | redisinsight-docker-entrypoint | 0 | 3.0.0-r1 |
| Chainguard | renovate | 0 | 42.71.4-r0 |
| Chainguard | saf | 0 | 1.5.3-r1 |
| Chainguard | sqlpad | 0 | 7.5.7-r5 |
| Chainguard | sqlpad-compat | 0 | 7.5.7-r4 |
| Chainguard | thingsboard | 0 | 4.2.1.1-r0 |
| Chainguard | thingsboard-tb-js-executor | 0 | 4.2.1.1-r0 |
| Chainguard | thingsboard-tb-mqtt-transport | 0 | 4.2.1.1-r0 |
| Chainguard | thingsboard-tb-node | 0 | 4.2.1.1-r0 |
| Chainguard | thingsboard-tb-web-ui | 0 | 4.2.1.1-r0 |
| Chainguard | tileserver-gl | 0 | 5.5.0-r0 |
| Chainguard | tileserver-gl-compat | 0 | 5.5.0-r0 |
| Chainguard | tileserver-gl-fips | 0 | 5.5.0-r0 |
| Chainguard | tileserver-gl-fips-compat | 0 | 5.5.0-r0 |
| Wolfi | argo-workflow-cli-3.7 | 0 | 3.7.6-r1 |
| Wolfi | argo-workflow-controller-3.7 | 0 | 3.7.6-r1 |
| Wolfi | argo-workflow-controller-3.7-compat | 0 | 3.7.6-r1 |
| Wolfi | argo-workflow-executor-3.7 | 0 | 3.7.6-r1 |
| Wolfi | argo-workflow-executor-3.7-compat | 0 | 3.7.6-r1 |
| Wolfi | argo-workflows-3.7 | 0 | 3.7.6-r1 |
| Wolfi | argo-workflows-known-hosts-3.7 | 0 | 3.7.6-r1 |
| Wolfi | argo-workflows-ui-3.7 | 0 | 3.7.7-r0 |
| Wolfi | code-server | 0 | 4.106.3-r1 |
| Wolfi | code-server-compat | 0 | 4.106.3-r1 |
| Wolfi | json-server | 0 | 0.17.4-r3 |
| Wolfi | kubeflow-centraldashboard | 0 | 1.10.0-r8 |
| Wolfi | kubeflow-pipelines | 0 | 2.15.0-r5 |
| Wolfi | kubeflow-pipelines-apiserver | 0 | 2.15.0-r5 |
| Wolfi | kubeflow-pipelines-cache-deployer | 0 | 2.15.0-r5 |
| Wolfi | kubeflow-pipelines-cache-deployer-compat | 0 | 2.15.0-r5 |
| Wolfi | kubeflow-pipelines-cache_server | 0 | 2.15.0-r5 |
| Wolfi | kubeflow-pipelines-frontend | 0 | 2.15.0-r12 |
| Wolfi | kubeflow-pipelines-metadata-envoy-config | 0 | 2.15.0-r5 |
| Wolfi | kubeflow-pipelines-metadata-writer | 0 | 2.15.0-r5 |
| Wolfi | kubeflow-pipelines-metadata-writer-compat | 0 | 2.15.0-r5 |
| Wolfi | kubeflow-pipelines-persistence_agent | 0 | 2.15.0-r5 |
| Wolfi | kubeflow-pipelines-scheduledworkflow | 0 | 2.15.0-r5 |
| Wolfi | kubeflow-pipelines-viewer-crd-controller | 0 | 2.15.0-r5 |
| Wolfi | langfuse-3 | 0 | 3.143.0-r1 |
| Wolfi | langfuse-3-compat | 0 | 3.143.0-r1 |
| Wolfi | langfuse-3-worker | 0 | 3.143.0-r1 |
| Wolfi | langfuse-web-3 | 0 | 3.143.0-r1 |
| Wolfi | langfuse-web-compat | 0 | 3.143.0-r1 |
| Wolfi | langfuse-worker-3 | 0 | 3.143.0-r1 |
| Wolfi | opensearch-dashboards-2 | 0 | 2.19.4-r10 |
| Wolfi | opensearch-dashboards-2-alerting-dashboards-plugin | 0 | 2.19.4-r10 |
| Wolfi | opensearch-dashboards-2-anomaly-detection-dashboards-plugin | 0 | 2.19.4-r5 |
| Wolfi | opensearch-dashboards-2-config | 0 | 2.19.4-r4 |
| Wolfi | opensearch-dashboards-2-dashboards-maps | 0 | 2.19.4-r5 |
| Wolfi | opensearch-dashboards-2-dashboards-notifications | 0 | 2.19.4-r10 |
| Wolfi | opensearch-dashboards-2-dashboards-observability | 0 | 2.19.4-r15 |
| Wolfi | opensearch-dashboards-2-dashboards-query-workbench | 0 | 2.19.4-r10 |
| Wolfi | opensearch-dashboards-2-dashboards-reporting | 0 | 2.19.4-r10 |
| Wolfi | opensearch-dashboards-2-dashboards-search-relevance | 0 | 2.19.5-r4 |
| Wolfi | opensearch-dashboards-2-dashboards-visualizations | 0 | 2.19.4-r10 |
| Wolfi | opensearch-dashboards-2-index-management-dashboards-plugin | 0 | 2.19.4-r10 |
| Wolfi | opensearch-dashboards-2-ml-commons-dashboards | 0 | 2.19.4-r5 |
| Wolfi | opensearch-dashboards-2-security-analytics-dashboards-plugin | 0 | 2.19.4-r10 |
| Wolfi | opensearch-dashboards-2-security-dashboards-plugin | 0 | 2.19.4-r10 |
| Wolfi | opensearch-dashboards-3 | 0 | 3.5.0-r0 |
| Wolfi | opensearch-dashboards-3-alerting-dashboards-plugin | 0 | 3.5.0-r0 |
| Wolfi | opensearch-dashboards-3-anomaly-detection-dashboards-plugin | 0 | 3.4.0-r0 |
| Wolfi | opensearch-dashboards-3-config | 0 | 3.2.0-r2 |
| Wolfi | opensearch-dashboards-3-dashboards-maps | 0 | 3.4.0-r0 |
| Wolfi | opensearch-dashboards-3-dashboards-notifications | 0 | 3.5.0-r1 |
| Wolfi | opensearch-dashboards-3-dashboards-observability | 0 | 3.5.0-r5 |
| Wolfi | opensearch-dashboards-3-dashboards-query-workbench | 0 | 3.5.0-r1 |
| Wolfi | opensearch-dashboards-3-dashboards-reporting | 0 | 3.5.0-r1 |
| Wolfi | opensearch-dashboards-3-dashboards-search-relevance | 0 | 3.5.0-r5 |
| Wolfi | opensearch-dashboards-3-index-management-dashboards-plugin | 0 | 3.5.0-r1 |
| Wolfi | opensearch-dashboards-3-ml-commons-dashboards | 0 | 3.4.0-r0 |
| Wolfi | opensearch-dashboards-3-security-analytics-dashboards-plugin | 0 | 3.5.0-r1 |
| Wolfi | opensearch-dashboards-3-security-dashboards-plugin | 0 | 3.5.0-r1 |
| Wolfi | renovate | 0 | 42.71.4-r0 |
| Wolfi | saf | 0 | 1.5.3-r1 |
| Wolfi | sqlpad | 0 | 7.5.7-r5 |
| Wolfi | sqlpad-compat | 0 | 7.5.7-r4 |
| Wolfi | thingsboard | 0 | 4.2.1.1-r0 |
| Wolfi | thingsboard-tb-js-executor | 0 | 4.2.1.1-r0 |
| Wolfi | thingsboard-tb-mqtt-transport | 0 | 4.2.1.1-r0 |
| Wolfi | thingsboard-tb-node | 0 | 4.2.1.1-r0 |
Related vulnerabilities
- CVE-2025-15284 Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue… Same vulnerability
- GHSA-q8mj-m7cp-5q26 qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined… Also affects qs
- CVE-2026-8723 ### Summary `qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and… Also affects qs
- GHSA-r5fr-rjxr-66jc lodash vulnerable to Code Injection via `_.template` imports key names Also affects arangodb-3.11
- GHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` Also affects arangodb-3.11
- CVE-2026-4800 Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm)… Also affects arangodb-3.11
- CVE-2026-2950 Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the… Also affects arangodb-3.11
- CVE-2026-33228 flatted is a circular JSON parser. Also affects arangodb-3.11