CVE-2026-82417: CWE-248 Uncaught Exception in ljharb qs

The ljharb qs library's stringify function calls utils.isBuffer on non-primitive values, which invokes obj.constructor.isBuffer without checking if it is a function. If an object has a constructor property with a truthy but non-callable isBuffer property, this leads to a TypeError being thrown. This can be triggered by attacker-controlled input parsed with qs.parse using options that preserve the constructor property (e.g., allowPrototypes: true). The vulnerability affects versions >=2.2.5 and <6.16.0. The fix, released in v6.16.0, adds a typeof check to ensure isBuffer is a function before calling it, preventing the throw. The impact is denial of service via synchronous exceptions during serialization, potentially causing process exit if unhandled.

An unauthenticated attacker can cause any code path that re-serializes attacker-influenced data with qs.stringify to throw a synchronous TypeError. In typical Node.js HTTP frameworks, this results in a 500 error response for the affected request, with the process continuing to serve other requests. However, if the serialization occurs outside of error boundaries, such as in async Express 4 handlers or background jobs, the unhandled exception can cause the process to exit, leading to denial of service. There is no impact on confidentiality or integrity, only availability.

A fix is available and was released in version 6.16.0 of the qs library. Users should upgrade to version 6.16.0 or later to resolve this issue. Until upgraded, applications should ensure that untrusted input is not parsed or serialized in ways that preserve or expose the constructor property with a non-callable isBuffer member. Proper error handling around qs.stringify calls can also mitigate process crashes in async or background contexts.