CVE-2026-82417: ### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member…

### Summary


`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: "x" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.


### Details


`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.


Such an object can be built from untrusted input. `qs.parse("x[constructor][isBuffer]=y", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse("{\"a\":{\"constructor\":{\"isBuffer\":\"x\"}}}")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.


#### PoC


```js


var qs = require("qs");


qs.stringify(qs.parse("x[constructor][isBuffer]=y", { plainObjects: true }));


qs.stringify(JSON.parse("{\"a\":{\"constructor\":{\"isBuffer\":\"x\"}}}"));


// TypeError: obj.constructor.isBuffer is not a function


// at Object.isBuffer (lib/utils.js:332:78)


// at stringify (lib/stringify.js:127:45)


```


#### Fix


`lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:


```diff


- return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj));


+ return !!(obj.constructor && typeof obj.constructor.isBuffer === "function" && obj.constructor.isBuff

Affected

CVSS provenance