TypeError in Data Serialization for qs Library by Node.js

CVE-2026-82417

What is CVE-2026-82417?

The qs library in Node.js has a critical issue where it throws a TypeError when serializing objects with specific non-callable properties. This occurs during the invocation of utils.isBuffer, which incorrectly assumes obj.constructor.isBuffer is a callable function without verification. This vulnerability can be exploited through untrusted input, potentially terminating the process when the error is unhandled. It affects versions from 2.2.5 to 6.15.3, and has been resolved in version 6.16.0.

References