[Fix] parse: enforce arrayLimit on comma groups under []= when throwOnLimitExceeded is set

With `comma: true` and `throwOnLimitExceeded: true`,
`parseArrayValue` only ran the pre-split comma count for flat values
(`isFlatArrayValue`);
a comma group under a `[]=` key was split unconditionally and then wrapped as a single nested element,
so its length was never compared against `arrayLimit`,
while `a=`, `a[0]=`, `a[b]=`, and `a.b=` all threw.
The same gate also exempted object input.

Drop the gate so every comma-split value is counted before splitting. 
An in-limit group under `a[]=` still counts as one element of the outer array,
and the default (non-throwing) path is unchanged.

This closes the `[]=` key form that the CVE-2026-2391 fix (f6a7abf) did not cover.

Author: ljharb

lib/parse.js

@@ -36,9 +36,9 @@ var interpretNumericEntities = function (str) {
     });
 };
 
-var parseArrayValue = function (val, options, currentArrayLength, isFlatArrayValue) {
+var parseArrayValue = function (val, options, currentArrayLength) {
     if (val && typeof val === 'string' && options.comma && val.indexOf(',') > -1) {
-        if (isFlatArrayValue && options.throwOnLimitExceeded) {
+        if (options.throwOnLimitExceeded) {
             var commaCount = 0;
             var commaIndex = val.indexOf(',');
             while (commaIndex > -1) {
@@ -125,8 +125,7 @@ var parseValues = function parseQueryStringValues(str, options) {
                     parseArrayValue(
                         part.slice(pos + 1),
                         options,
-                        isArray(obj[key]) ? obj[key].length : 0,
-                        part.indexOf('[]=') === -1
+                        isArray(obj[key]) ? obj[key].length : 0
                     ),
                     function (encodedVal) {
                         return options.decoder(encodedVal, defaults.decoder, charset, 'value');

test/parse.js

@@ -1589,6 +1589,134 @@ test('parse()', function (t) {
             sst.end();
         });
 
+        st.test('throws before splitting when a bracketed comma group exceeds arrayLimit', function (sst) {
+            sst['throws'](
+                function () {
+                    qs.parse('a[]=1,2,3,4,5,6', { comma: true, arrayLimit: 5, throwOnLimitExceeded: true });
+                },
+                new RangeError('Array limit exceeded. Only 5 elements allowed in an array.'),
+                'the inner group is itself an array and is subject to arrayLimit'
+            );
+            sst.end();
+        });
+
+        st.test('throws before splitting when a comma group under `[]=` exceeds arrayLimit', function (sst) {
+            sst['throws'](
+                function () {
+                    qs.parse('a[]=1,2,3,4', { comma: true, arrayLimit: 3, throwOnLimitExceeded: true });
+                },
+                new RangeError('Array limit exceeded. Only 3 elements allowed in an array.'),
+                'a bracket-push comma group over the limit throws like the flat form'
+            );
+
+            sst['throws'](
+                function () {
+                    qs.parse('a[]=1,2', { comma: true, arrayLimit: 1, throwOnLimitExceeded: true });
+                },
+                new RangeError('Array limit exceeded. Only 1 element allowed in an array.'),
+                'singular message at arrayLimit 1'
+            );
+
+            sst['throws'](
+                function () {
+                    qs.parse('a[b][]=1,2,3,4', { comma: true, arrayLimit: 3, throwOnLimitExceeded: true });
+                },
+                new RangeError('Array limit exceeded. Only 3 elements allowed in an array.'),
+                'a nested bracket-push key throws'
+            );
+
+            sst['throws'](
+                function () {
+                    qs.parse('a[][]=1,2,3,4', { comma: true, arrayLimit: 3, throwOnLimitExceeded: true });
+                },
+                new RangeError('Array limit exceeded. Only 3 elements allowed in an array.'),
+                'a doubly bracket-pushed key throws'
+            );
+
+            sst['throws'](
+                function () {
+                    qs.parse('a[]=5&a[]=1,2,3,4', { comma: true, arrayLimit: 3, throwOnLimitExceeded: true });
+                },
+                new RangeError('Array limit exceeded. Only 3 elements allowed in an array.'),
+                'an oversized group appended after a scalar throws'
+            );
+
+            sst['throws'](
+                function () {
+                    qs.parse('a[]=1,2,3,4&a[]=5', { comma: true, arrayLimit: 3, throwOnLimitExceeded: true });
+                },
+                new RangeError('Array limit exceeded. Only 3 elements allowed in an array.'),
+                'an oversized group throws even when a later part would fit'
+            );
+
+            sst['throws'](
+                function () {
+                    qs.parse('a[]=1,2,3,4&a[]=5', { comma: true, arrayLimit: 3, throwOnLimitExceeded: true, duplicates: 'first' });
+                },
+                new RangeError('Array limit exceeded. Only 3 elements allowed in an array.'),
+                'throws with duplicates: first'
+            );
+
+            sst['throws'](
+                function () {
+                    qs.parse('a[]=5&a[]=1,2,3,4', { comma: true, arrayLimit: 3, throwOnLimitExceeded: true, duplicates: 'last' });
+                },
+                new RangeError('Array limit exceeded. Only 3 elements allowed in an array.'),
+                'throws with duplicates: last'
+            );
+
+            sst['throws'](
+                function () {
+                    qs.parse({ a: '1,2,3,4' }, { comma: true, arrayLimit: 3, throwOnLimitExceeded: true });
+                },
+                new RangeError('Array limit exceeded. Only 3 elements allowed in an array.'),
+                'an oversized comma value in object input throws'
+            );
+
+            var big = 'a[]=' + new Array(1e5 + 1).join('1,') + '1';
+            sst['throws'](
+                function () {
+                    qs.parse(big, { comma: true, arrayLimit: 3, throwOnLimitExceeded: true });
+                },
+                new RangeError('Array limit exceeded. Only 3 elements allowed in an array.'),
+                'a very long bracket-push comma group throws'
+            );
+            sst.end();
+        });
+
+        st.test('does not throw for a comma group under `[]=` within arrayLimit', function (sst) {
+            sst.deepEqual(
+                qs.parse('a[]=1,2,3', { comma: true, arrayLimit: 3, throwOnLimitExceeded: true }),
+                { a: [['1', '2', '3']] },
+                'an inner group exactly at the limit stays a single nested element'
+            );
+            sst.deepEqual(
+                qs.parse('a[]=1,2,3&a[]=4,5,6&a[]=7', { comma: true, arrayLimit: 3, throwOnLimitExceeded: true }),
+                { a: [['1', '2', '3'], ['4', '5', '6'], '7'] },
+                'each group counts as one element of the outer array'
+            );
+            sst.deepEqual(
+                qs.parse('a[b][]=1,2,3', { comma: true, arrayLimit: 3, throwOnLimitExceeded: true }),
+                { a: { b: [['1', '2', '3']] } },
+                'nested bracket-push key within the limit'
+            );
+            sst.deepEqual(
+                qs.parse({ a: '1,2,3' }, { comma: true, arrayLimit: 3, throwOnLimitExceeded: true }),
+                { a: ['1', '2', '3'] },
+                'object input within the limit'
+            );
+            sst.end();
+        });
+
+        st.test('keeps an oversized comma group under `[]=` as a nested array without throwOnLimitExceeded', function (sst) {
+            sst.deepEqual(
+                qs.parse('a[]=1,2,3,4', { comma: true, arrayLimit: 3 }),
+                { a: [['1', '2', '3', '4']] },
+                'the inner group is not converted to an overflow object'
+            );
+            sst.end();
+        });
+
         st.test('throws for a bracketed comma group when arrayLimit is 0', function (sst) {
             sst['throws'](
                 function () {