#7371·sails

Dependency vulnerability: qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion

Author: SimonLandeholmCreated Jan 19, 2026Updated Feb 13, 2026
Labelstry this out please

Sails version: 1.5.3

qs <6.14.1 Severity: high qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion - https://github.com/advisories/GHSA-6rw7-vpxm-498p fix available via npm audit fix --force Will install [email protected], which is a breaking change node_modules/qs node_modules/waterline-utils/node_modules/qs body-parser <=1.20.3 || 2.0.0-beta.1 - 2.0.2 Depends on vulnerable versions of qs node_modules/body-parser express 2.5.8 - 2.5.11 || 3.2.1 - 3.2.3 || 4.0.0-rc1 - 4.21.2 || 5.0.0-alpha.1 - 5.0.1 Depends on vulnerable versions of body-parser Depends on vulnerable versions of qs node_modules/express sails <=0.8.895 || >=0.12.4-rc1 Depends on vulnerable versions of express Depends on vulnerable versions of skipper node_modules/sails skipper >=0.6.0 Depends on vulnerable versions of body-parser node_modules/skipper waterline-utils >=1.4.1 Depends on vulnerable versions of qs node_modules/waterline-utils