qs vulnerabilities

A vulnerability in the qs library allows bypassing the arrayLimit for comma-separated values when comma: true and throwOnLimitExceeded: true are used. This affects bracket-push keys (a[]=), where the value is split into an array without checking the limit, enabling allocation of arbitrarily large arrays. The issue affects versions >=6.14.2 <6.16.0 and is fixed in 6.16.0.

The `qs.stringify` function in the qs library throws a `TypeError` when serializing an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. The duck-typing check in `utils.isBuffer` invokes `obj.constructor.isBuffer(obj)` without verifying it is a function, causing the error. Affected versions are from 2.2.5 to 6.15.3, fixed in 6.16.0.

A vulnerability in the qs library (parse module) involves improper input validation — the arrayLimit option was not enforced for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This allows arrays larger than the defined limit to be created. The default parameterLimit (1000) effectively mitigates the practical impact.