CVE-2026-82417

Description

### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: "x" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`. ### Details `lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call. Such an object can be built from untrusted input. `qs.parse("x[constructor][isBuffer]=y", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse("{\"a\":{\"constructor\":{\"isBuffer\":\"x\"}}}")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly. #### PoC ```js var qs = require("qs"); qs.stringify(qs.parse("x[constructor][isBuffer]=y", { plainObjects: true })); qs.stringify(JSON.parse("{\"a\":{\"constructor\":{\"isBuffer\":\"x\"}}}")); // TypeError: obj.constructor.isBuffer is not a function // at Object.isBuffer (lib/utils.js:332:78) // at stringify (lib/stringify.js:127:45) ``` #### Fix `lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0: ```diff - return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj)); + return !!(obj.constructor && typeof obj.constructor.isBuffer === "function" && obj.constructor.isBuffer(obj)); ``` Real `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed. ### Affected versions `>=2.2.5 <6.16.0`, fixed in v6.16.0. The unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call. ### Impact An unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs.

CVSS Metrics

• v4.0•MEDIUM•Score: 6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
• v4.0•MEDIUM•Score: 6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
• v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS Trends

Current EPSS score: 0.26%• Percentile: 18%

Techniques & Countermeasures

• CWE-248•Uncaught Exception

  An exception is thrown from a function, but it is not caught.

• CWE-703•Improper Check or Handling of Exceptional Conditions

  The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.

Affected Systems

• chainguard•arangodb-3.11

  < 3.11.14.5-r18

• chainguard•arangodb-3.12

  < 3.12.9.4-r31

• chainguard•argo-workflows-ui-4.0

  < 4.0.11-r0

• chainguard•azurite

  < 3.36.0-r4

• chainguard•code-server

  < 4.135.0-r2

• chainguard•commercial-gitlab-rails-ee-19.1

  all

• chainguard•commercial-gitlab-rails-ee-19.2

  all

• chainguard•commercial-gitlab-rails-ee-19.3

  all

• chainguard•commercial-gitlab-rails-ee-fips-19.1

  all

• chainguard•commercial-gitlab-rails-ee-fips-19.2

  all

• chainguard•commercial-gitlab-rails-ee-fips-19.3

  all

• chainguard•dotstatsuite-supercore

  < 3.1.0_git20260903-r0

• chainguard•gitlab-rails-ce-18.10

  all

• chainguard•gitlab-rails-ce-18.11

  all

• chainguard•gitlab-rails-ce-18.7

  all

• chainguard•gitlab-rails-ce-18.8

  all

• chainguard•gitlab-rails-ce-18.9

  all

• chainguard•gitlab-rails-ce-19.0

  all

• chainguard•gitlab-rails-ce-19.1

  all | < 19.1.7-r6

• chainguard•gitlab-rails-ce-19.3

  < 19.3.1-r6

• chainguard•gitlab-rails-ce-fips-18.10

  all

• chainguard•gitlab-rails-ce-fips-18.11

  all

• chainguard•gitlab-rails-ce-fips-18.7

  all

• chainguard•gitlab-rails-ce-fips-18.8

  all

• chainguard•gitlab-rails-ce-fips-18.9

  all

• chainguard•gitlab-rails-ce-fips-19.0

  all

• chainguard•gitlab-rails-ce-fips-19.1

  all | < 19.1.7-r7

• chainguard•json-server

  all | < 0.17.4-r13

• chainguard•jupyter-base-notebook

  all

• chainguard•kibana-9.2

  all

• chainguard•kibana-9.2-iamguarded

  all

• chainguard•kibana-9.3

  all

• chainguard•kibana-9.3-iamguarded

  all

• chainguard•kibana-9.4

  < 9.4.6-r2

• chainguard•kibana-9.4-iamguarded

  < 9.4.6-r2

• chainguard•kibana-9.5

  < 9.5.3-r1

• chainguard•kibana-9.5-iamguarded

  < 9.5.3-r1

• chainguard•kubeflow-centraldashboard

  < 2.0.0-r2

• chainguard•kubescape-grype-offline-db

  all | < 0_git20250804-r6

• chainguard•langfuse-3

  all | < 3.225.7-r1

• chainguard•langfuse-3-compat

  < 3.225.7-r6

• chainguard•langfuse-3-worker

  all | < 3.225.7-r1

• chainguard•langfuse-4

  < 4.27.0-r3

• chainguard•langfuse-4-worker

  < 4.27.0-r3

• chainguard•langfuse-fips-3

  < 3.225.5-r2

• chainguard•langfuse-fips-3-worker

  < 3.225.5-r2

• chainguard•langfuse-fips-4

  < 4.26.0-r1

• chainguard•langfuse-fips-4-worker

  < 4.26.0-r1

• chainguard•opensearch-dashboards-2

  < 2.19.6-r16

• chainguard•opensearch-dashboards-2-alerting-dashboards-plugin

  < 2.19.6-r17

Showing first 50 affected entries in server-rendered view.

References (9)

• https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g
• https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6
• https://security-tracker.debian.org/tracker/CVE-2026-82417
• https://ubuntu.com/security/CVE-2026-82417
• https://www.cve.org/CVERecord?id=CVE-2026-82417
• https://nvd.nist.gov/vuln/detail/CVE-2026-82417
• https://github.com/ljharb/qs
• https://npmjs.com/qs
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82417.json