CVE-2026-82417

Name of the Vulnerable Software and Affected Versions qs versions 2.2.5 through 6.15.3

Description The qs.stringify function can throw a TypeError when serializing an object that contains a constructor property with a truthy, non-callable isBuffer member. This occurs because the utils.isBuffer() function performs duck-typing by invoking obj.constructor.isBuffer(obj) without first verifying that isBuffer is actually a function. An attacker can trigger this by providing specially crafted input via qs.parse (using plainObjects: true or allowPrototypes: true) or through JSON.parse. In environments like Express 4 or body-parser with extended: true, such input can be passed directly through req.query or req.body. This can lead to a denial of service where the affected request returns a 500 error, or in cases where the call occurs outside an error boundary (such as in an async handler), it may cause the entire process to exit.

Recommendations Update qs to version 6.16.0 or later.