[GHSA-6rw7-vpxm-498p] qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion #6627
Conversation
|
Hi there @ljharb! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
github-actions
bot
changed the base branch from
main
to
abdelkabirouadoukou/advisory-improvement-6627
There was a problem hiding this comment.
Pull request overview
This PR updates the GitHub Security Advisory for CVE-2025-15284, which addresses a DoS vulnerability in the qs library where the arrayLimit option fails to enforce limits for bracket notation.
Key Changes:
- Removes CVSS v3 scoring from the advisory
- Retains CVSS v4 scoring (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)
- Updates the modified timestamp to reflect the change
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
Could you clarify the change you want to make to the advisory? |
|
i intentionally included cvss v3 and v4 scores, this should be closed. |
Updates
Comments
.