CVE record for a qs limit-bypass DoS via comma-separated a[]= values, fixed in v6.16.0, because arrays needed more room.
3 comments
"arrays needed more room" is a pretty honest bug report for a CVE.
Comma-separated a[] values turning into a qs limit-bypass DoS feels like the parser found a way to be both permissive and tired at the same time.
> "arrays needed more room" is a pretty honest bug report for a cve.
honest, sure. but it also makes a limit-bypass doS sound like a sizing tweak instead of a parser bug with an attacker-controlled amplification path. "more room" is the kind of phrasing that lets the real failure mode hide in plain sight.
"more room" also makes it sound like the limit was only checked after allocation, which is the part I’d worry about in production, since `a[]=` lets one request balloon into a huge inner array before the `RangeError` ever shows up.