AZL-98331 CVE-2026-82417 affecting package js-jquery 3.5.0-4

🗓️ 30 Aug 2026 00:16:34Reported by GoogleType

osv_azl🔗 osv.dev👁 27 Views

TypeError in qs.stringify via js-jquery 3.5.0-4 when constructor.isBuffer is non-callable.

Reporter	Title	Published	Views	Family All 411
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor component uses multiple third-party libraries that are vulnerable to several security vulnerabilities.	3 Nov 202610:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security QRadar Log Management AQL Plugin contains components with known vulnerabilities	13 Oct 202603:19	–	ibm
IBM Security Bulletins	Security Bulletin: vulnerability in [email protected]	23 Oct 202621:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in qs	28 Sep 202614:23	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.	3 Nov 202620:26	–	ibm
IBM Security Bulletins	Security Bulletin:qs.stringify TypeError: obj.constructor.isBuffer is not a function when serializing objects with own constructor.isBuffer property	7 Oct 202618:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules	12 Oct 202620:20	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Data Product Hub	21 Oct 202619:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Decision Intelligence Client Managed Software (Formerly Known as IBM Automation Decision Services) for Sept 2026- Multiple CVEs addressed	5 Oct 202616:26	–	ibm
Chainguard	CVE-2026-82417 vulnerabilities	3 Sep 202614:18	–	cgr

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-82417

05 Nov 2026 05:36Current

7.2High risk

Vulners AI Score7.2

CVSS 3.15.3

CVSS 46.3

EPSS0.00396

SSVC

js-jquery qs stringify TypeError denial of service buffer duck-typing untrusted input