AIKIDO-2026-10054
qs_dart is vulnerable to Denial of Service (DoS)
25
Low Risk
This Affects:
qs_dartTL;DR
Affected versions of the package are vulnerable to denial-of-service conditions due to insufficient enforcement of array limits during query string decoding. Crafted inputs can cause arrays to grow beyond the configured listLimit, leading to excessive memory consumption. The updated decoding logic introduces explicit overflow tracking and converts oversized arrays into map-based representations when limits are exceeded, aligning behavior with Node.js qs semantics and preventing unbounded memory growth.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
qs_dart is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 1.6.0.
How to fix this
Upgrade the qs_dart library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant