CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad

CVE-2025-15284

The Limit Does Not Exist: Crashing Node.js via CVE-2025-15284

Amit Schendel
Amit Schendel
Senior Security Researcher

Jan 1, 2026·5 min read·102 visits

Executive Summary (TL;DR)

The `qs` library, used by Express and others to parse query strings, has a setting called `arrayLimit` to prevent memory exhaustion. Versions < 6.14.1 fail to apply this limit to bracket notation (`key[]=value`). Attackers can send a single request with thousands of keys to crash the server. Patch immediately to 6.14.1.

A logic flaw in the ubiquitous `qs` library allows attackers to bypass the `arrayLimit` security control using bracket notation. This enables unauthenticated Denial of Service (DoS) attacks against Node.js applications by exhausting server memory with massive arrays.

Official Patches

qs (GitHub)Commit fixing the logic flaw in parse.js

Fix Analysis (1)

Technical Appendix

CVSS Score
7.5/ 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Probability
0.10%
Top 100% most exploited

Affected Systems

Node.js applications using `express`NestJS applicationsKoa applications using `koa-qs`Any Node.js service using `qs < 6.14.1`

Affected Versions Detail

Product
Affected Versions
Fixed Version
qs
ljharb
< 6.14.16.14.1
AttributeDetail
CWE IDCWE-20
Attack VectorNetwork
CVSS7.5 (High)
ImpactDenial of Service (DoS)
Exploit StatusPoC Available
Fixed Version6.14.1

MITRE ATT&CK Mapping

T1499.004Endpoint Denial of Service: Application or System Exploitation
Impact
CWE-20
Improper Input Validation

Improper Input Validation

Known Exploits & Detection

GitHub Security AdvisoryAdvisory containing PoC for arrayLimit bypass

Vulnerability Timeline

Patch committed to GitHub
2025-02-17
GitHub Security Advisory Published
2025-02-18

References & Sources

  • [1]NVD - CVE-2025-15284
  • [2]GitHub Advisory: qs arrayLimit Bypass

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•about 1 hour ago•CVE-2026-53766
6.1

CVE-2026-53766: Workspace Boundary Bypass in chrome-devtools-mcp via Symbolic Link Resolution Failure

A workspace boundary bypass vulnerability exists in the Chrome DevTools for Agents (chrome-devtools-mcp) Model Context Protocol (MCP) server from version 0.24.0 up to 1.1.0. The vulnerability allows an agent or malicious workspace containing symbolic links to read or modify arbitrary files outside the configured project workspace root directory. This occurs because the path validation function resolves paths lexically rather than physically.

Alon Barad
Alon Barad
1 views•7 min read
•about 2 hours ago•CVE-2026-56677
8.6

CVE-2026-56677: Unauthenticated Server-Side Request Forgery in 9Router OIDC Test Endpoint

A high-severity security vulnerability exists in 9Router, an AI router and token saver dashboard. When dashboard authentication features are disabled or left in default configurations, the application exposes administrative testing routines directly to the public internet. Unauthenticated network adversaries can exploit the OIDC configuration validation endpoint to initiate arbitrary HTTP requests, routing unauthorized traffic to local loops, adjacent container ports, and cloud resource metadata interfaces.

Amit Schendel
Amit Schendel
2 views•5 min read
•about 3 hours ago•CVE-2026-64849
9.3

CVE-2026-64849: Server-Side Request Forgery (SSRF) in MLflow Webhooks via DNS Rebinding

CVE-2026-64849 is a critical Server-Side Request Forgery (SSRF) vulnerability affecting MLflow tracking servers prior to version 3.15.0. It allows unauthenticated remote attackers to bypass outbound request destination filters using DNS rebinding or HTTP redirects. This exposure risks compromising sensitive cloud infrastructure metadata and internal microservices.

Alon Barad
Alon Barad
3 views•5 min read
•about 4 hours ago•CVE-2026-69146
6.5

CVE-2026-69146: Missing Authorization Bypass in MLflow Basic Authentication Middleware

This technical report details a missing authorization vulnerability (CVE-2026-69146 / GHSA-3p64-6gvh-82v5) affecting the MLflow platform from version 3.13.0 to 3.15.0. When MLflow is configured with the built-in basic-auth plugin, authenticated users can bypass run-level UPDATE authorization checks, enabling unauthorized dataset and model lineage metadata injection.

Alon Barad
Alon Barad
2 views•7 min read
•about 5 hours ago•CVE-2026-69148
7.1

CVE-2026-69148: Broken Object Level Authorization (BOLA) in MLflow Model Registry

MLflow prior to version 3.15.0 fails to perform proper authorization checks when registering model versions, allowing authenticated users with access to a registered model to link and access artifacts from runs and models belonging to other users without authorization.

Amit Schendel
Amit Schendel
5 views•7 min read
•about 6 hours ago•CVE-2026-59893
7.5

CVE-2026-59893: Regular Expression Denial of Service in sqlparse Lexer

A high-severity Regular Expression Denial of Service (ReDoS) vulnerability in the sqlparse Python library prior to version 0.6.0 allows unauthenticated remote attackers to trigger CPU exhaustion and application denial of service via crafted SQL inputs containing unmatched dollar-quoted literals or unclosed multiline comments.

Alon Barad
Alon Barad
6 views•6 min read