AIKIDO-2026-35535

TL;DR

The parseArrayValue helper in the parse path splits a comma-separated value into an array before comparing it against arrayLimit. When a comma group is supplied under a bracket-push key such as a[]=1,2,3, the code treats it as exempt and skips the limit check even when throwOnLimitExceeded is enabled, while the equivalent flat key correctly throws. Untrusted input can therefore expand a single parameter into an arbitrarily large array, consuming excessive memory. The fix applies the arrayLimit check to every comma group and throws a RangeError before splitting when the limit is exceeded.