CVE-2026-82417 in ljharb
Summary
by MITRE • 08/30/2026
### Summary
`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: "x" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.
### Details
`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.
Such an object can be built from untrusted input. `qs.parse("x[constructor][isBuffer]=y", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse("{\"a\":{\"constructor\":{\"isBuffer\":\"x\"}}}")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.
#### PoC
```js
var qs = require("qs");
qs.stringify(qs.parse("x[constructor][isBuffer]=y", { plainObjects: true }));
qs.stringify(JSON.parse("{\"a\":{\"constructor\":{\"isBuffer\":\"x\"}}}"));
// TypeError: obj.constructor.isBuffer is not a function
// at Object.isBuffer (lib/utils.js:332:78)
// at stringify (lib/stringify.js:127:45)
```
#### Fix
`lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:
```diff
- return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj));
+ return !!(obj.constructor && typeof obj.constructor.isBuffer === "function" && obj.constructor.isBuffer(obj));
```
Real `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed.
### Affected versions
`>=2.2.5 <6.16.0`, fixed in v6.16.0.
The unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.
### Impact
An unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/30/2026
The vulnerability identified involves a type confusion issue within the qs library's stringify function, specifically affecting versions from 2.2.5 up to but not including 6.16.0. This flaw arises because the internal utility function responsible for detecting Node.js Buffer instances fails to validate that the isBuffer method it intends to invoke is actually callable. The detection logic relies on duck-typing by accessing obj.constructor.isBuffer and immediately invoking it if the property exists and appears truthy. However, this approach does not verify whether the value assigned to isBuffer is a function or some other data type such as a string or number. Consequently, when an attacker supplies an object where the constructor's isBuffer property holds a non-function value, the JavaScript engine throws a TypeError because it attempts to execute a non-callable entity as if it were a method.
This technical flaw has significant operational implications for web applications that utilize qs for parsing and serializing query strings or request bodies. In typical Node.js HTTP frameworks like Express 4 with body-parser configured in extended mode, user-supplied input is parsed using qs.parse with options that allow prototype pollution-like behaviors such as allowing plain objects to retain their constructor properties. If an attacker crafts a specific payload, they can inject an object structure where the constructor contains a maliciously crafted isBuffer property. When this data is subsequently re-serialized by any part of the application logic that calls qs.stringify, the unguarded call triggers a synchronous exception. In standard web server configurations, this results in a 500 Internal Server Error response to the attacker's request, effectively causing a denial of service for that specific transaction while leaving other requests unaffected due to framework-level error handling boundaries.
The severity and impact vary depending on how the application handles exceptions around the serialization logic. If qs.stringify is called within an async handler without proper promise rejection handling in Express 4 or similar environments, the unhandled promise rejection can cause the entire Node.js process to crash, leading to a complete denial of service for all users until the server restarts. This scenario transforms what might otherwise be a minor reliability issue into a critical availability vulnerability. The attack vector is straightforward and does not require authentication, as it relies solely on manipulating HTTP request parameters or JSON body content that gets processed by vulnerable middleware stacks.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation because the application fails to adequately validate user-supplied input before processing it in a way that assumes specific data types and structures. It also relates to CWE-476 NULL Pointer Dereference or more accurately CWE-94 Code Injection via improper control of execution flow, though technically it is an uncaught exception due to type mismatch rather than code injection per se. In the context of the MITRE ATT&CK framework, this could be categorized under T1505 Server Software Component which involves installing or using malicious components, although here the component itself has a flaw that leads to availability impact similar to Denial of Service techniques found in T1499 Endpoint Denial of Service.
The root cause was introduced in commit 3768a75 and shipped starting with version 2.2.5 in September 2014, replacing an earlier implementation that used the safer Buffer.isBuffer method directly. The fix implemented in version 6.16.0 adds a critical type check using typeof to ensure that obj.constructor.isBuffer is indeed a function before attempting to invoke it. This change preserves backward compatibility for legitimate buffer instances while preventing the exception from being thrown on maliciously crafted inputs. Organizations running affected versions should upgrade immediately to v6.16.0 or later. For those unable to update, implementing input validation at the application layer to sanitize constructor properties in parsed objects can serve as a temporary mitigation strategy until patching is possible.