CVE-2026-82417 json
qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property
published 2mo ago modified 2mo ago also EUVD-2026-68140 , GHSA-4mjr-xmp4-gh2g
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 34%
- public exploits
- 0
- none known
Summary
### Summary
`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: "x" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.
### Details
`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.
Such an object can be built from untrusted input. `qs.parse("x[constructor][isBuffer]=y", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse("{\"a\":{\"constructor\":{\"isBuffer\":\"x\"}}}")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.
#### PoC
```js
var qs = require("qs");
qs.stringify(qs.parse("x[constructor][isBuffer]=y", { plainObjects: true }));
qs.stringify(JSON.parse("{\"a\":{\"constructor\":{\"isBuffer\":\"x\"}}}"));
// TypeError: obj.constructor.isBuffer is not a function
// at Object.isBuffer (lib/utils.js:332:78)
// at stringify (lib/stringify.js:127:45)
```
#### Fix
`lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:
```diff
- return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj));
+ return !!(obj.constructor && typeof obj.constructor.isBuffer === "function" && obj.constructor.isBuffer(obj));
```
Real `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed.
### Affected versions
`>=2.2.5 <6.16.0`, fixed in v6.16.0.
The unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.
### Impact
An unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs.
Patch / fix
- npm qs 6.16.0
- ljharb qs 6.16.0
- node-qs Debian 14 6.16.0+ds+~6.15.1-1
debian advisories DEBIAN-CVE-2026-82417
- grafana13.1 hummingbird 1 13.1.3-0.4.hum1
- grafana13.2 hummingbird 1 13.2.1-0.1.hum1
red hat advisories RHSA-2026:62544RHSA-2026:63164
- github.com/ljharb/qs@e83d321 commit
Is CVE-2026-82417 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-82417 updated cvss 7.5
qs: qs: Denial of Service via improper validation in stringify function
-
Red Hat Ansible Automation Orchestrator 2026 ansible-automation-platform/automation-orchestrator-ui-rhel9 Red Hat Cost Management On Premise costmanagement/costmanagement-ui-rhel10 Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel8, workload-availability/node-healthcheck-rhel9-operator, workload-availability/node-healthcheck-operator-bundle, workload-availability/node-healthcheck-must-gather-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9, openshift-lightspeed/lightspeed-agentic-console-rhel9, openshift-lightspeed/lightspeed-console-plugin-419-rhel9, openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9affected: workaround, no fix available
-
Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9, openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-console-plugin-rhel9, openshift-pipelines/pipelines-console-plugin-pf5-rhel9affected: workaround, no fix available, no fix planned “Will not fix”
-
Red Hat OpenShift Serverless openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9, +3 moreaffected: workaround, no fix available
-
Red Hat Ansible Automation Platform 2 automation-controller 4.5.35-1.el9ap, ansible-automation-platform-24/lightspeed-rhel8, ansible-automation-platform-27/mcp-server-rhel9, ansible-automation-platform-tech-preview/mcp-server-rhel9, automation-eda-controller 1.0.10-0.1.20260317.git9cae940.el8apaffected: workaround, no fix available, no fix planned “Will not fix”
-
Red Hat Build of Podman Desktop rh-podman-desktop.git 1.1.0affected: workaround, no fix available
-
Red Hat Ceph Storage 4 cockpit-ceph-installer, rhceph/rhceph-4-dashboard-rhel8 Red Hat Ceph Storage 6 ceph, cephadm, librbd1, librgw2, rbd-nbd, ceph-mib, +16 more Red Hat Ceph Storage 7 ceph, cephadm, librbd1, librgw2, rbd-nbd, ceph-mib, +16 more Red Hat Ceph Storage 8 ceph, cephadm, librbd1, librgw2, rbd-nbd, ceph-mib, +17 more Red Hat Ceph Storage 9 ceph, cephadm, librbd1, librgw2, rbd-nbd, ceph-mib, +17 moreaffected: workaround, no fix available “Fix deferred”
-
Red Hat Connectivity Link 1 rhcl-1/rhcl-console-plugin-rhel9 Red Hat Enterprise Linux 9 sgx-mpa, tdx-qgs, sgx-libs, sgx-pccs, sgx-common, sgx-pccs-admin, +2 moreaffected: workaround, no fix available
-
Red Hat Enterprise Linux 10 ceph, linux-sgx 2.26-7.el10, nodejs26 26.1.0-1.el10, nodejs22 22.23.1-3.el10_0, nodejs24 24.19.0-1.el10_2 Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/disk-image-cuda-rhel9affected: workaround, no fix available, no fix planned “Will not fix”
show 19 moreshow fewer
-
Red Hat Fuse 7 qs 6.5.2 Red Hat Hardened Images nodejs25 25.9.0-1.6.hum1, nodejs20 20.20.2-1.2.hum1 Red Hat JBoss Enterprise Application Platform 7 jboss-eap-patch.zip 7.4.23, jboss-eap-maven-repository.zip 7.4.23, jboss-eap-runtime-maven-repository.zip 7.4.24, jboss-eap-full-maven-repository.zip 7.4.22.GA-CR1, jboss-eap-incremental-maven-repository.zip 7.4.23affected: workaround, no fix planned “Will not fix”
-
Red Hat OpenShift AI (RHOAI) rhoai/odh-core-bff-rhel9, rhoai/odh-dashboard-operator-rhel9, rhoai/odh-mod-arch-agent-ops-rhel9 Red Hat OpenShift Container Platform 5 openshift5/ose-monitoring-plugin-rhel9, openshift5/ose-agent-installer-ui-rhel9 Red Hat Openshift Data Foundation 4 odf4/mcg-core-rhel9affected: workaround, no fix available
-
Red Hat OpenShift GitOps microshift-gitops 1.19.2-36.el9, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9, openshift-gitops-argocd-cli 1.19.2-36.el9affected: workaround, no fix planned “Will not fix”
-
Red Hat Trusted Profile Analyzer rhtpa/rhtpa-rhel10, rhtpa/rhtpa-trustification-service-rhel9affected: workaround, no fix available, no fix planned “Will not fix”
-
Red Hat Secrets Management Console for Red Hat OpenShift external-secrets-management/console-plugin-rhel9affected: workaround, no fix planned “Will not fix”
-
Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/distributed-tracing-console-plugin-rhel9 1793661918, cluster-observability-operator/distributed-tracing-console-plugin-rhel9 1793824908, cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9 1793661804, cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9 1793823428, cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9 1793664067, cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9 1793825585, +2 morefixed: vendor fix RHSA-2026:95591
-
Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-openshift-console-plugin-rhel9 4.2.0-19fixed: vendor fix RHSA-2026:95360
-
Red Hat Advanced Cluster Security for Kubernetes 4.11 advanced-cluster-security/rhacs-main-rhel9 1789411320fixed: vendor fix RHSA-2026:67714
-
Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 advanced-cluster-security/rhacs-main-rhel8 1789411269fixed: vendor fix RHSA-2026:67711
-
Red Hat Ansible Automation Platform 2.1 ansible-automation-platform/automation-portal 1790254963fixed: vendor fix RHSA-2026:72712
-
Red Hat Ansible Automation Platform 2.2 ansible-automation-platform/automation-portal 1790256405, ansible-automation-platform/bootc-automation-portal-rhel9 1791865660fixed: vendor fix RHSA-2026:72722
-
Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25/lightspeed-rhel8 1789685837fixed: vendor fix RHSA-2026:71210
-
Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/lightspeed-rhel9 1789656884fixed: vendor fix RHSA-2026:71179
-
Red Hat Developer Hub 1.10 rhdh/rhdh-hub-rhel9 1791311495, rhdh/red-hat-developer-hub-backstage-plugin-lightspeed 1791242743, rhdh/red-hat-developer-hub-backstage-plugin-orchestrator 1791250003, rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend 1791242697, rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend 1791251282, rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets 1791250794, +2 morefixed: vendor fix RHSA-2026:76788
-
Red Hat Discovery 2 discovery/discovery-ui-rhel9 1789677459fixed: vendor fix RHSA-2026:69289
-
Red Hat Hardened Images grafana13.1 13.1.3-0.4.hum1, grafana13.2 13.2.1-0.1.hum1fixed: vendor fix RHSA-2026:62544
-
Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-ui-rhel8 1789546373fixed: vendor fix RHSA-2026:68681
-
Red Hat Migration Toolkit for Applications 8.2 mta/mta-ui-rhel9 1789446780fixed: vendor fix RHSA-2026:67724
-
Red Hat OpenShift AI 2.25 rhoai/odh-dashboard-rhel9 1791853525, rhoai/odh-feature-server-rhel9 1792148523, rhoai/odh-mod-arch-model-registry-rhel9 1791853432, rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 1791288400fixed: vendor fix RHSA-2026:87410
12 more fixed, 39 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2mo ago
Exploit prediction
0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-11).
Exploits and checks
- github.com https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | qs | >=2.2.5, <6.16.0 |
6.16.0 |
Affected products
- ljharb qs
Classification
References
-
github.com
/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6
patch, web
-
github.com
/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g
vendor-advisory, exploit, web, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-82417
advisory
-
github.com
/ljharb/qs
package
Sources
- CVE List CVE-2026-82417
- GitHub Advisory GHSA-4mjr-xmp4-gh2g
- NVD CVE-2026-82417
- Maintainer advisory GHSA-4mjr-xmp4-gh2g
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of ljharb/qs published their own advisory on GitHub. Reviewed sources take precedence over it.