{"id":"CVE-2026-82417","summary":"qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property","details":"### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.\n\n\n\nSuch an object can be built from untrusted input. `qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true }));\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\"));\n\n\n\n// TypeError: obj.constructor.isBuffer is not a function\n\n\n\n//     at Object.isBuffer (lib/utils.js:332:78)\n\n\n\n//     at stringify (lib/stringify.js:127:45)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:\n\n\n\n```diff\n\n\n\n- return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj));\n\n\n\n+ return !!(obj.constructor && typeof obj.constructor.isBuffer === \"function\" && obj.constructor.isBuffer(obj));\n\n\n\n```\n\n\n\nReal `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed.\n\n\n\n### Affected versions\n\n\n\n`\u003e=2.2.5 \u003c6.16.0`, fixed in v6.16.0.\n\n\n\nThe unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs.","aliases":["GHSA-4mjr-xmp4-gh2g"],"modified":"2026-09-01T03:30:33.472991271Z","published":"2026-08-29T23:51:27.634Z","database_specific":{"unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"2.2.5"},{"fixed":"6.16.0"}]}],"cna_assigner":"harborist","cwe_ids":["CWE-248","CWE-703"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82417.json"},"references":[{"type":"WEB","url":"https://npmjs.com/qs"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82417.json"},{"type":"ADVISORY","url":"https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82417"},{"type":"FIX","url":"https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6"},{"type":"PACKAGE","url":"https://github.com/ljharb/qs"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ljharb/qs","events":[{"introduced":"211cbd9cd9ba6d16a5459c13073bc3a6b1dec018"},{"fixed":"18d085e919dae70c8f1b200ab99323058edab2c2"},{"fixed":"e83d321ffafb38cf210683ac31714fce6ce1c6c6"}],"database_specific":{"source":["DESCRIPTION","REFERENCES"],"extracted_events":[{"introduced":"v2.2.5"},{"fixed":"v6.15.3"}]}}],"versions":["v6.15.3","v6.15.2","v6.15.1","v6.15.0","v6.14.2","v6.10.5","v6.11.2","v6.12.3","v6.13.1","v6.14.1","v6.14.0","v6.13.0","v6.12.2","v6.12.1","v6.12.0","v6.11.1","v6.11.0","v6.10.4","v6.10.3","v6.10.2","v6.10.1","v6.10.0","v6.9.6","v6.9.5","v6.9.4","v6.9.3","v6.9.2","v6.9.1","v6.9.0","v6.8.0","v6.7.0","v6.6.0","v6.5.2","v6.4.0","v6.5.1","v6.5.0","v6.3.1","v6.1.0","v6.2.1","v6.3.0","v5.2.0","v6.2.0","v6.0.2","v6.0.1","v6.0.0","v5.1.0","v5.0.0","v4.0.0","v3.1.0","v3.0.0","v2.4.2","v2.4.1","v2.4.0","v2.3.3","v2.3.2","v2.3.1","v2.3.0","v2.2.5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82417.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}