EUVD-2026-68140

qs: Denial of Service via Attacker Controlled isBuffer...

AZL-98397 CVE-2026-82417 affecting package python-tensorboard 2.16.2-6

Summary qs.stringify throws a TypeError when it serializes an object whose own constructor property has a truthy, non-callable isBuffer member. utils.isBuffer duck-types buffers by calling obj.constructor.isBufferobj after checking only that the property is truthy, so a value such as constructor:...

AZL-98331 CVE-2026-82417 affecting package js-jquery 3.5.0-4

Summary qs.stringify throws a TypeError when it serializes an object whose own constructor property has a truthy, non-callable isBuffer member. utils.isBuffer duck-types buffers by calling obj.constructor.isBufferobj after checking only that the property is truthy, so a value such as constructor:...

Linux Distros Unpatched Vulnerability : CVE-2026-82417

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Summary qs.stringify throws a TypeError when it serializes an object whose own constructor property has a truthy, non-callable isBuffer member. utils.isBuffer...

CVE-2026-82417

CVE-2026-82417 is a synchronous crash in the qs query-string library (Node.js). utils.isBuffer in lib/utils.js duck-types Buffer objects by invoking obj.constructor.isBuffer(obj) after only a truthy check, so any object carrying its own constructor property with a truthy, non-callable isBuffer me...

PT-2026-83502

Name of the Vulnerable Software and Affected Versions qs versions 2.2.5 through 6.15.3 Description The qs.stringify function can throw a TypeError when serializing an object that contains a constructor property with a truthy, non-callable isBuffer member. This occurs because the utils.isBuffer...