AIKIDO-2026-10054

TL;DR

Affected versions of the package are vulnerable to denial-of-service conditions due to insufficient enforcement of array limits during query string decoding. Crafted inputs can cause arrays to grow beyond the configured listLimit, leading to excessive memory consumption. The updated decoding logic introduces explicit overflow tracking and converts oversized arrays into map-based representations when limits are exceeded, aligning behavior with Node.js qs semantics and preventing unbounded memory growth.