An improper input validation vulnerability in the qs library version 6.14.1 and earlier could lead to a denial of service condition.

This is a CWE-20 Improper Input Validation flaw where the arrayLimit option fails to properly restrict array sizes when using bracket notation. An unauthenticated attacker can supply crafted input to bypass these limits, potentially exhausting system resources.

Successful exploitation could result in a denial of service, rendering applications using the affected qs module unresponsive or causing them to crash. While the CVSS score of 7.5 reflects a significant risk, the impact is partially mitigated by default parameter limits, which naturally cap the number of processed elements.

Immediate Action: Update the qs library to version 6.14.1 or later immediately to apply the necessary input validation checks.

Proactive Monitoring: Monitor application server logs for unusually large or malformed HTTP requests that contain excessive bracket notation patterns.

Compensating Controls: Ensure that web application firewalls or load balancers are configured to limit the maximum size and complexity of incoming HTTP request parameters.

Public Exploit Available: No (exploit_available: false)

Organizations utilizing the qs library in Node.js environments must prioritize upgrading to version 6.14.1. Although default parameter limits provide some protection, updating is the only definitive way to close the validation gap and prevent potential resource exhaustion attacks.