Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1. Summary The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations. Note: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly. Details The arrayLimit option only checked limits for indexed notation (a[0]=1&a[1]=2) but did not enforce it for bracket notation (a[]=1&a[]=2). Vulnerable code (lib/parse.js:159-162): if (root === '[]' && options.parseArrays) { obj = utils.combine([], leaf); // No arrayLimit check } Working code (lib/parse.js:175): else if (index <= options.arrayLimit) { // Limit checked here obj = []; obj[index] = leaf; } The bracket notation handler at line 159 uses utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175 checks index <= options.arrayLimit before creating arrays. PoC const qs = require('qs'); const result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5 }); console.log(result.a.length); // Output: 6 (should be max 5) Note on parameterLimit interaction: The original advisory's "DoS demonstration" claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000. Impact Consistency bug in arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit is explicitly set to a very high value.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-18480 advisory.

    [2.26-7]
    - Fix pccs npm security flaws

    [2.26-6]
    - Port to pycryptography and pyasn1 and make keyring optional

    [2.26-5]
    - Sync specfile changes from Fedora

    [2.26-4]
    - Drop sgx-mpa dep from sgx-pccs

    [2.26-3]
    - Add scriptlets for PCCS

    [2.26-2]
    - Enable pccsadmin everywhere

    [2.26-1]
    - Update to SGX 2.26 / DCAP 1.23, adding PCCS service

    [2.25-7]
    - Trigger udev to set perms on /dev/sgx_provision

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1143:03 advisory.

    * qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)
      * node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in     archives (CVE-2026-23745)
      * node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition     (CVE-2026-23950)
      * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)
      * node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check     (CVE-2026-24842)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:33371 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.3.18 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 7.3.17, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 7.3.18 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * jose4j: From CVEorg collector (CVE-2024-29371)

    * undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache     Poisoning and SSRF (CVE-2025-12543)

    * org.apache.cxf/cxf-core: Apache CXF: Denial of Service vulnerability with temporary files     (CVE-2025-23184)

    * undertow-core: Undertow MadeYouReset HTTP/2 DDoS Vulnerability (CVE-2025-9784)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-18868 advisory.

    [2.26-7]
    - Fix pccs npm security flaws

    [2.26-6]
    - Port to pycryptography and pyasn1 and make keyring optional

    [2.26-5]
    - Sync specfile changes from Fedora

    [2.26-4]
    - Drop sgx-mpa dep from sgx-pccs

    [2.26-3]
    - Add scriptlets for PCCS

    [2.26-2]
    - Enable pccsadmin everywhere

    [2.26-1]
    - Update to SGX 2.26 / DCAP 1.23, adding PCCS service

    [2.25-7]
    - Trigger udev to set perms on /dev/sgx_provision

    [2.25-6]
    - Temporarily disable automatic tier1 gating

    [2.25-5]
    - Adapt qgs.service for SELinux policy and sock perms

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:18480 advisory.

    * qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)

    * node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in     archives (CVE-2026-23745)

    * node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition     (CVE-2026-23950)

    * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)

    * node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check     (CVE-2026-24842)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:18868 advisory.

    * qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)

    * node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in     archives (CVE-2026-23745)

    * node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition     (CVE-2026-23950)

    * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)

    * node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check     (CVE-2026-24842)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:18868 advisory.

    The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software     developers to create and debug Intel SGX enabled applications in C/C++.

    Security Fix(es):

    * qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)

    * node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in     archives (CVE-2026-23745)

    * node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition     (CVE-2026-23950)

    * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)

    * node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check     (CVE-2026-24842)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:18480 advisory.

    The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software     developers to create and debug Intel SGX enabled applications in C/C++.

    Security Fix(es):

    * qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)

    * node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in     archives (CVE-2026-23745)

    * node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition     (CVE-2026-23950)

    * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)

    * node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check     (CVE-2026-24842)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 10 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a84e0ad039 advisory.

    Update nodejs modules used by pccs daemon for CVE-2026-23745, CVE-2026-23950, CVE-2026-24842,     CVE-2025-13465, CVE-2025-15284.
    Remove Fedora override of default pccs daemon port.
    Remove redundant dep on mpa_registration from pccs.
    Add system scriptlets for pccs server.
    Port to pycryptography & pyasn1.
    Fix tracebacks in keyring code.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Atlassian Jira Service Management Data Center and Server (Jira Service Desk) running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16491 advisory.

  - Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: <     6.14.1. SummaryThe arrayLimit option in qs does not enforce limits for bracket notation (a[]=1&a[]=2),     allowing attackers to cause denial-of-service via memory exhaustion. Applications using arrayLimit for DoS     protection are vulnerable. DetailsThe arrayLimit option only checks limits for indexed notation     (a[0]=1&a[1]=2) but completely bypasses it for bracket notation (a[]=1&a[]=2). Vulnerable code     (lib/parse.js:159-162): if (root === '[]' && options.parseArrays) { obj = utils.combine([], leaf); // No     arrayLimit check } Working code (lib/parse.js:175): else if (index <= options.arrayLimit) { // Limit     checked here obj = []; obj[index] = leaf; } The bracket notation handler at line 159 uses     utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175     checks index <= options.arrayLimit before creating arrays. PoCTest 1 - Basic bypass: npm install qs const     qs = require('qs'); const result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5 });
    console.log(result.a.length); // Output: 6 (should be max 5) Test 2 - DoS demonstration: const qs =     require('qs'); const attack = 'a[]=' + Array(10000).fill('x').join('&a[]='); const result =     qs.parse(attack, { arrayLimit: 100 }); console.log(result.a.length); // Output: 10000 (should be max 100)     Configuration: * arrayLimit: 5 (test 1) or arrayLimit: 100 (test 2) * Use bracket notation: a[]=value (not     indexed a[0]=value) ImpactDenial of Service via memory exhaustion. Affects applications using qs.parse()     with user-controlled input and arrayLimit for protection. Attack scenario: * Attacker sends HTTP request:
    GET /api/search?filters[]=x&filters[]=x&...&filters[]=x (100,000+ times) * Application parses with     qs.parse(query, { arrayLimit: 100 }) * qs ignores limit, parses all 100,000 elements into array * Server     memory exhausted  application crashes or becomes unresponsive * Service unavailable for all users Real-     world impact: * Single malicious request can crash server * No authentication required * Easy to automate     and scale * Affects any endpoint parsing query strings with bracket notation (CVE-2025-15284)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0007 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-15284:
    Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: <     6.14.1.


    SummaryThe arrayLimitoption in qs does not enforce limits for bracket notation (a[]=1&a[]=2), allowing     attackers to cause denial-of-service via memory exhaustion. Applications using arrayLimitfor DoS     protection are vulnerable.

    DetailsThe arrayLimitoption only checks limits for indexed notation (a[0]=1&a[1]=2) but completely     bypasses it for bracket notation (a[]=1&a[]=2).

    Vulnerable code(lib/parse.js:159-162):

    if (root === '[]' && options.parseArrays) {       obj = utils.combine([], leaf);  // No arrayLimit check     }





    Working code(lib/parse.js:175):

    else if (index <= options.arrayLimit) {  // Limit checked here       obj = [];
      obj[index] = leaf;
    }





    The bracket notation handler at line 159 uses utils.combine([], leaf)without validating against     options.arrayLimit, while indexed notation at line 175 checks index <= options.arrayLimitbefore creating     arrays.

    PoCTest 1 - Basic bypass:

    npm install qs





    const qs = require('qs');
    const result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5 });
    console.log(result.a.length);  // Output: 6 (should be max 5)





    Test 2 - DoS demonstration:

    const qs = require('qs');
    const attack = 'a[]=' + Array(10000).fill('x').join('&a[]=');
    const result = qs.parse(attack, { arrayLimit: 100 });
    console.log(result.a.length);  // Output: 10000 (should be max 100)





    Configuration:

    *  arrayLimit: 5(test 1) or arrayLimit: 100(test 2)
    *  Use bracket notation: a[]=value(not indexed a[0]=value)


    ImpactDenial of Service via memory exhaustion. Affects applications using qs.parse()with user-controlled     input and arrayLimitfor protection.

    Attack scenario:

    *  Attacker sends HTTP request: GET /api/search?filters[]=x&filters[]=x&...&filters[]=x(100,000+ times)
    *  Application parses with qs.parse(query, { arrayLimit: 100 })
    *  qs ignores limit, parses all 100,000 elements into array
    *  Server memory exhausted  application crashes or becomes unresponsive
    *  Service unavailable for all users     Real-world impact:

    *  Single malicious request can crash server
    *  No authentication required
    *  Easy to automate and scale
    *  Affects any endpoint parsing query strings with bracket notation

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: <
    6.14.1. Summary The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2),
    only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across
    all array notations. Note: The default parameterLimit of 1000 effectively mitigates the DoS scenario
    originally described. With default options, bracket notation cannot produce arrays larger than
    parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity
    has been reduced accordingly. Details The arrayLimit option only checked limits for indexed notation
    (a[0]=1&a[1]=2) but did not enforce it for bracket notation (a[]=1&a[]=2). Vulnerable code
    (lib/parse.js:159-162): if (root === '[]' && options.parseArrays) { obj = utils.combine([], leaf); // No
    arrayLimit check } Working code (lib/parse.js:175): else if (index <= options.arrayLimit) { // Limit
    checked here obj = []; obj[index] = leaf; } The bracket notation handler at line 159 uses
    utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175
    checks index <= options.arrayLimit before creating arrays. PoC const qs = require('qs'); const result =
    qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5 }); console.log(result.a.length); //
    Output: 6 (should be max 5) Note on parameterLimit interaction: The original advisory's "DoS
    demonstration" claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000
    parameters. With default options, the actual output is 1,000, not 10,000. Impact Consistency bug in
    arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since
    parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket
    notation). The risk increases only when parameterLimit is explicitly set to a very high value.
    (CVE-2025-15284)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: <     6.14.1. Summary The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2),     only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across     all array notations. Note: The default parameterLimit of 1000 effectively mitigates the DoS scenario     originally described. With default options, bracket notation cannot produce arrays larger than     parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity     has been reduced accordingly. Details The arrayLimit option only checked limits for indexed notation     (a[0]=1&a[1]=2) but did not enforce it for bracket notation (a[]=1&a[]=2). Vulnerable code     (lib/parse.js:159-162): if (root === '[]' && options.parseArrays) { obj = utils.combine([], leaf); // No     arrayLimit check } Working code (lib/parse.js:175): else if (index <= options.arrayLimit) { // Limit     checked here obj = []; obj[index] = leaf; } The bracket notation handler at line 159 uses     utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175     checks index <= options.arrayLimit before creating arrays. PoC const qs = require('qs'); const result =     qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5 }); console.log(result.a.length); //     Output: 6 (should be max 5) Note on parameterLimit interaction: The original advisory's DoS     demonstration claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000     parameters. With default options, the actual output is 1,000, not 10,000. Impact Consistency bug in     arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since     parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket     notation). The risk increases only when parameterLimit is explicitly set to a very high value.
    (CVE-2025-15284)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
327008	Oracle Linux 10 : linux-sgx (ELSA-2026-18480)	Nessus	Oracle Linux Local Security Checks	high
325184	MiracleLinux 9 : linux-sgx-2.26-7.el9 (AXSA:2026-1143:03)	Nessus	Miracle Linux Local Security Checks	high
323872	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.3.18 (RHSA-2026:33371)	Nessus	Red Hat Local Security Checks	high
322200	Oracle Linux 9 : linux-sgx (ELSA-2026-18868)	Nessus	Oracle Linux Local Security Checks	high
317966	RockyLinux 10 : linux-sgx (RLSA-2026:18480)	Nessus	Rocky Linux Local Security Checks	high
317439	RockyLinux 9 : linux-sgx (RLSA-2026:18868)	Nessus	Rocky Linux Local Security Checks	high
315374	RHEL 9 : linux-sgx (RHSA-2026:18868)	Nessus	Red Hat Local Security Checks	high
315307	RHEL 10 : linux-sgx (RHSA-2026:18480)	Nessus	Red Hat Local Security Checks	high
299072	Fedora 43 : linux-sgx (2026-a84e0ad039)	Nessus	Fedora Local Security Checks	high
297642	Atlassian Jira Service Management Data Center and Server 10.3.x < 10.3.16 (JSDSERVER-16491)	Nessus	Misc.	medium
282604	TencentOS Server 4: grafana (TSSA-2026:0007)	Nessus	Tencent Local Security Checks	medium
436528	SCA: security update for qs (GHSA-6rw7-vpxm-498p)	Tenable Cloud Security	SCA Checks	medium
436528	SCA: security update for qs (GHSA-6rw7-vpxm-498p)	Tenable Self-Hosted Container Security	SCA Checks	medium
280190	Linux Distros Unpatched Vulnerability : CVE-2025-15284	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-15284

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

medium

medium

medium

medium

medium