{"id":"UBUNTU-CVE-2026-82417","details":"### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`. ### Details `lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call. Such an object can be built from untrusted input. `qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly. #### PoC ```js var qs = require(\"qs\"); qs.stringify(qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })); qs.stringify(JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")); // TypeError: obj.constructor.isBuffer is not a function //     at Object.isBuffer (lib/utils.js:332:78) //     at stringify (lib/stringify.js:127:45) ``` #### Fix `lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0: ```diff - return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj)); + return !!(obj.constructor && typeof obj.constructor.isBuffer === \"function\" && obj.constructor.isBuffer(obj)); ``` Real `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed. ### Affected versions `\u003e=2.2.5 \u003c6.16.0`, fixed in v6.16.0. The unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call. ### Impact An unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs.","modified":"2026-09-02T16:28:28Z","published":"2026-08-30T00:16:00Z","upstream":["CVE-2026-82417"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-82417"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-82417"},{"type":"REPORT","url":"https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g"},{"type":"REPORT","url":"https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6"}],"affected":[{"package":{"name":"node-qs","ecosystem":"Ubuntu:Pro:14.04:LTS","purl":"pkg:deb/ubuntu/node-qs?arch=source&distro=esm-infra-legacy%2Ftrusty"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.2-1","0.6.5-1","0.6.5-1ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"node-qs","binary_version":"0.6.5-1ubuntu0.1~esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-82417.json"}},{"package":{"name":"node-qs","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/node-qs?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.4-1"],"ecosystem_specific":{"binaries":[{"binary_version":"2.2.4-1","binary_name":"node-qs"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-82417.json"}},{"package":{"name":"node-qs","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/node-qs?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.4-1","2.2.4-1ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_version":"2.2.4-1ubuntu1","binary_name":"node-qs"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-82417.json"}},{"package":{"name":"node-qs","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/node-qs?arch=source&distro=esm-apps%2Ffocal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.2-1","6.9.0+ds-1","6.9.1+ds-1","6.9.1+ds-1ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"node-qs","binary_version":"6.9.1+ds-1ubuntu0.1~esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-82417.json"}},{"package":{"name":"node-qs","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/node-qs?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.9.4+ds-1","6.10.1+ds-1","6.10.2+ds+~6.9.7-1","6.10.3+ds+~6.9.7-1"],"ecosystem_specific":{"binaries":[{"binary_version":"6.10.3+ds+~6.9.7-1","binary_name":"node-qs"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-82417.json"}},{"package":{"name":"node-qs","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/node-qs?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0+ds+~6.9.7-3","6.11.0+ds+~6.9.7-4"],"ecosystem_specific":{"binaries":[{"binary_name":"node-qs","binary_version":"6.11.0+ds+~6.9.7-4"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-82417.json"}},{"package":{"name":"node-qs","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/node-qs?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.13.0+ds+~6.9.16-1","6.14.1+ds+~6.14.0-1"],"ecosystem_specific":{"binaries":[{"binary_version":"6.14.1+ds+~6.14.0-1","binary_name":"node-qs"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-82417.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]}