Please file a private vulnerability report via GitHub, email @ljharb, or see https://tidelift.com/security if you have a potential security vulnerability to report.
Please see our Incident Response Plan.
Please see THREAT_MODEL.md.
Security: ljharb/qs
Security
.github/SECURITY.md
-
arrayLimit bypass in bracket notation allows DoS via memory exhaustionGHSA-6rw7-vpxm-498p published
Dec 29, 2025 by ljharbHigh
Learn more about advisories related to ljharb/qs in the GitHub Advisory Database