Process hang via unchecked __proto__ query keys

Prototype pollution in affected qs releases before 6.10.3 allows remote attackers to hang Node.js processes via crafted query strings. The parseObject routine assigned recursively parsed values to attacker-controlled property names without excluding proto, creating array-like objects with attacker-set length values. In typical Express configurations, an unauthenticated query can reach the parser, and later string or array operations on the resulting object hang the Node.js process.