Preliminary research

When Two Parsers Disagree: Exploiting Query String Differentials for XSS

Amirmohammad Safari · Voorivex · 10 February 2026

AI-collected research leads through 22 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Uses a small Express application to explain mismatches between extended qs parsing and browser URLSearchParams. Bracket interpretation, normalized keys and a parameter-count cutoff let one parser validate a different value from the one later used by the browser. Complete constructions illustrate cross-parser validation errors.

Record

Researcher

Amirmohammad Safari

Published by

Voorivex

Date

10 February 2026

Topic

XSS

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Query parser differential challenge

Tags

• parser-differential
• url-parsing
• javascript
• nodejs
• express
• xss
• case-study
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Amirmohammad Safari, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 13 September 2026.