From 08bd7476013e495f0c16d38c2afda10f38f2ccaf Mon Sep 17 00:00:00 2001
From: RoomWithOutRoof <166608075+Jah-yee@users.noreply.github.com>
Date: Sun, 26 Apr 2026 03:09:55 +0800
Subject: [PATCH] lib: increase arrayLimit to 100 in parseExtendedQueryString

Fixes the issue where req.query converts to array when >20 values are present. The qs library default arrayLimit is 20, which causes issues when more than 20 duplicate query keys are used.

Fixes #7147
---
 lib/utils.js      |  3 ++-
 test/req.query.js | 10 ++++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/lib/utils.js b/lib/utils.js
index 4f21e7ef1e3..ed899de50c5 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -266,6 +266,7 @@ function createETagGenerator (options) {
 
 function parseExtendedQueryString(str) {
   return qs.parse(str, {
-    allowPrototypes: true
+    allowPrototypes: true,
+    arrayLimit: 100
   });
 }
diff --git a/test/req.query.js b/test/req.query.js
index c0d3c8376e9..95101d289f4 100644
--- a/test/req.query.js
+++ b/test/req.query.js
@@ -38,6 +38,16 @@ describe('req', function(){
         .get('/?user.name=tj')
         .expect(200, '{"user.name":"tj"}', done);
       });
+
+      it('should parse more than 20 array parameters as array', function (done) {
+        var app = createApp('extended');
+        // 25 tenancyIds values - more than the default qs arrayLimit of 20
+        var query = 'tenancyIds=35&tenancyIds=28&tenancyIds=149&tenancyIds=157&tenancyIds=158&tenancyIds=159&tenancyIds=161&tenancyIds=160&tenancyIds=162&tenancyIds=163&tenancyIds=164&tenancyIds=165&tenancyIds=166&tenancyIds=167&tenancyIds=7&tenancyIds=196&tenancyIds=195&tenancyIds=198&tenancyIds=70&tenancyIds=6&tenancyIds=75&tenancyIds=76&tenancyIds=77&tenancyIds=78&tenancyIds=79';
+
+        request(app)
+        .get('/?' + query)
+        .expect(200, '{"tenancyIds":["35","28","149","157","158","159","161","160","162","163","164","165","166","167","7","196","195","198","70","6","75","76","77","78","79"]}', done);
+      });
     });
 
     describe('when "query parser" is simple', function () {