[GHSA-6rw7-vpxm-498p] qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion

[rizwan-saddal]

Updates

• CVSS v3

Comments
qs patch to avoid any vulnerability

[github]

Hi there @ljharb! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

Pull request overview

This PR updates the security advisory for CVE-2025-15284, which addresses a DoS vulnerability in the qs library where the arrayLimit option fails to enforce limits for bracket notation. The change removes CVSS v3 scoring while retaining CVSS v4 scoring, and updates the modification timestamp.

• Removes CVSS v3 severity scoring
• Updates the modification timestamp to reflect the change

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[JonathanLEvans]

Hi @rizwan-saddal,

Could you clarify the change you are suggesting?

[rizwan-saddal]

This PR updates the security advisory for GHSA-6rw7-vpxm-498p, which addresses a DoS vulnerability in the qs library where the arrayLimit option fails to enforce limits for bracket notation. The change removes CVSS v3 scoring while retaining CVSS v4 scoring, and updates the modification timestamp.

Removes CVSS v3 severity scoring
Updates the modification timestamp to reflect the change

[ljharb]

right, but why? as i said above, i included both scores intentionally. They're both meant to be there.

[rizwan-saddal]

Thanks for notifying, closing the pull request