qs: Denial of Service via Attacker Controlled isBuffer

🗓️ 02 Sep 2026 14:45:13Reported by GitHub Advisory DatabaseType

Unauthenticated DoS in qs via TypeError in isBuffer during parse-stringify round-trip.

Reporter	Title	Published	Views	Family All 404
IBM Security Bulletins	Security Bulletin: IBM Security QRadar Log Management AQL Plugin contains components with known vulnerabilities	13 Oct 202603:19	–	ibm
IBM Security Bulletins	Security Bulletin: vulnerability in [email protected]	23 Oct 202621:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in qs	28 Sep 202614:23	–	ibm
IBM Security Bulletins	Security Bulletin:qs.stringify TypeError: obj.constructor.isBuffer is not a function when serializing objects with own constructor.isBuffer property	7 Oct 202618:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules	12 Oct 202620:20	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Data Product Hub	21 Oct 202619:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Decision Intelligence Client Managed Software (Formerly Known as IBM Automation Decision Services) for Sept 2026- Multiple CVEs addressed	5 Oct 202616:26	–	ibm
Chainguard	CVE-2026-82417 vulnerabilities	3 Sep 202614:18	–	cgr
Circl	CVE-2026-82417	2 Sep 202616:35	–	circl
CVE	CVE-2026-82417	29 Aug 202623:51	–	cve

Vulners

Node

qs_project qsRange2.2.5–6.16.0npm

Source	Link
github	www.github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-82417
github	www.github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6
github	www.github.com/advisories/GHSA-4mjr-xmp4-gh2g

02 Sep 2026 14:45Current

7.4High risk

Vulners AI Score7.4

CVSS 3.15.3

CVSS 46.3

EPSS0.00396

SSVC