fix: prevent `DecodeOptions.listLimit` bypass in bracket notation to mitigate potential DoS via memory exhaustion#46

Merged

techouse merged 11 commits intomainfrom

fix/qs-array-limit-bypass-in-bracket-notation-allows-dos-via-memory-exhaustion

Jan 11, 2026

Commits on Jan 11, 2026

fix: prevent array limit bypass in bracket notation to mitigate potential DoS via memory exhaustion
techouse
committed
fix: update listLimit semantics to prevent array limit bypass and ensure proper handling of empty-bracket pushes
techouse
committed
fix: clarify behavior of combine method regarding overflow objects
techouse
committed
fix: enhance overflow handling in map to support iterable sources
techouse
committed
fix: remove temporary list parsing disablement to prevent array limit bypass and enhance memory safety
techouse
committed
fix: enhance overflow handling in decode and utils to improve memory safety
techouse
committed
fix: add overflow index management methods to enhance memory safety
techouse
committed
fix: add tests for mixed list handling under tight list limits to ensure correct overflow tagging
techouse
committed
fix: enforce early throwing behavior during parsing to match Node `qs` implementation
techouse
committed
test: add test for combining iterable into existing overflow object to ensure correct behavior
techouse
committed
fix: optimize overflow handling in array merging to prevent memory exhaustion
techouse
committed