{"id":"CVE-2026-82417","title":"### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member","summary":"### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)`…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cwe":["CWE-248","CWE-703","CWE-1287"],"published":"2026-08-30","updated":"2026-08-30","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82417","references":[{"url":"https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6","label":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"},{"url":"https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g","label":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-82417.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-82417"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525936"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-82417"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82417"},{"url":"https://access.redhat.com/errata/RHSA-2026:62544"},{"url":"https://access.redhat.com/errata/RHSA-2026:63164"},{"url":"https://access.redhat.com/errata/RHSA-2026:67711"},{"url":"https://access.redhat.com/errata/RHSA-2026:67714"},{"url":"https://access.redhat.com/errata/RHSA-2026:68681"},{"url":"https://access.redhat.com/errata/RHSA-2026:67724"},{"url":"https://access.redhat.com/errata/RHSA-2026:69255"},{"url":"https://access.redhat.com/errata/RHSA-2026:68766"},{"url":"https://access.redhat.com/errata/RHSA-2026:68747"},{"url":"https://access.redhat.com/errata/RHSA-2026:69289"},{"url":"https://access.redhat.com/errata/RHSA-2026:71210"},{"url":"https://access.redhat.com/errata/RHSA-2026:71179"},{"url":"https://access.redhat.com/errata/RHSA-2026:68552"}],"tags":["nvd","csaf","vex","red-hat","score-dispute"],"ingestedAt":"2026-08-30T13:53:03.130Z","epss":0.00418,"epssPercentile":0.33366,"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","affected":["cost_management_on_premise","cryostat 4","migration_toolkit_for_applications 8","migration_toolkit_for_containers","node_healthcheck_operator","openshift_lightspeed","openshift_pipelines","openshift_serverless","advanced_cluster_management_for_kubernetes 2","advanced_cluster_security 4","ansible_automation_platform 2","build_of_podman_desktop","ceph_storage 4","ceph_storage 6","ceph_storage 7","ceph_storage 8","ceph_storage 9","connectivity_link 1","data_grid 8","developer_hub","discovery 2","enterprise_linux 10","enterprise_linux 7","enterprise_linux 8","enterprise_linux 9","enterprise_linux_ai_rhel_ai 3","fuse 7","hardened_images","jboss_enterprise_application_platform 7","openshift_ai_rhoai","openshift_container_platform 4","openshift_data_foundation 4","openshift_dev_spaces","openshift_gitops","quay 3","satellite 6","trusted_artifact_signer","trusted_profile_analyzer","secrets_management_console_for_red_hat_openshift","self_service_automation_portal 2"],"patched":["hardened_images"],"scores":{"nvd":5.3,"vendor":7.5},"slug":"CVE-2026-82417","body":"## Overview\n\n### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.\n\n\n\nSuch an object can be built from untrusted input. `qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true }));\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\"));\n\n\n\n// TypeError: obj.constructor.isBuffer is not a function\n\n\n\n//     at Object.isBuffer (lib/utils.js:332:78)\n\n\n\n//     at stringify (lib/stringify.js:127:45)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:\n\n\n\n```diff\n\n\n\n- return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj));\n\n\n\n+ return !!(obj.constructor && typeof obj.constructor.isBuffer === \"function\" && obj.constructor.isBuffer(obj));\n\n\n\n```\n\n\n\nReal `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed.\n\n\n\n### Affected versions\n\n\n\n`>=2.2.5 <6.16.0`, fixed in v6.16.0.\n\n\n\nThe unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:62544** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:62544)\n- **RHSA-2026:63164** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63164)\n- **Red Hat VEX** · Important · affected: Ansible Automation Orchestrator 2026, Cost Management On Premise, Cryostat 4, Node HealthCheck Operator, OpenShift Lightspeed, OpenShift Pipelines, … · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 10, Red Hat Fuse 7, Red Hat Hardened Images, … · updated 2026-09-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-82417.json)\n- **RHSA-2026:67711** · Red Hat · fixed in: Red Hat Advanced Cluster Security for Kubernetes 4.10 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67711)\n- **RHSA-2026:67714** · Red Hat · fixed in: Red Hat Advanced Cluster Security for Kubernetes 4.11 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67714)\n- **RHSA-2026:68681** · Red Hat · fixed in: Red Hat Migration Toolkit 1.8 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68681)\n- **RHSA-2026:67724** · Red Hat · fixed in: Red Hat Migration Toolkit for Applications 8.2 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:67724)\n- **RHSA-2026:69255** · Red Hat · fixed in: Red Hat Quay 3.16 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69255)\n- **RHSA-2026:68766** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68766)\n- **RHSA-2026:68747** · Red Hat · fixed in: Red Hat Satellite 6.19 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68747)\n- **RHSA-2026:69289** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69289)\n- **RHSA-2026:71210** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71210)\n- **RHSA-2026:71179** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71179)\n- **RHSA-2026:68552** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:68552)","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}