CVE-2025-15284

CVE-2025-15284 is an Improper Input Validation vulnerability in the qs library (versions prior to 6.14.1) that affects its parse modules. Specifically, the arrayLimit option failed to enforce limits for bracket notation (a[]=1), allowing for larger arrays than intended. While the CVSS score is 3.7 LOW due to the default parameterLimit mitigating most DoS scenarios, the vulnerability could lead to a denial-of-service if parameterLimit is set to a very high value. There is no evidence of active exploitation, and no public exploit code is available, though it has received some community discussion regarding remediation.