AZL-98331 CVE-2026-82417 affecting package js-jquery 3.5.0-4

Summary qs.stringify throws a TypeError when it serializes an object whose own constructor property has a truthy, non-callable isBuffer member. utils.isBuffer duck-types buffers by calling obj.constructor.isBufferobj after checking only that the property is truthy, so a value such as constructor:...

CVE-2026-82417

CVE-2026-82417 is a synchronous crash in the qs query-string library (Node.js). utils.isBuffer in lib/utils.js duck-types Buffer objects by invoking obj.constructor.isBuffer(obj) after only a truthy check, so any object carrying its own constructor property with a truthy, non-callable isBuffer me...