{"uuid": "9129a4c6-1ca3-4606-8b4f-c5c3753075b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2391", "type": "seen", "source": "https://bsky.app/profile/scoutmonitoring.bsky.social/post/3mvll2opgrm2q", "content": "Express 5.3.0 fixes CVE-2026-2391: a qs arrayLimit bypass that let arbitrarily large arrays in a query string cause a DoS. Also fixes a Content-Length/Transfer-Encoding header conflict in res.send(). Update if you're on Express. github.com/expressjs/ex...", "creation_timestamp": "2026-09-15T21:30:09.991462Z"}