Security Bulletin:qs.stringify TypeError: obj.constructor.isBuffer is not a function when serializing objects with own constructor.isBuffer property

Summary Summary qs.stringify throws a TypeError when it serializes an object whose own constructor property has a truthy, non-callable isBuffer member. utils.isBuffer duck-types buffers by calling obj.constructor.isBufferobj after checking only that the property is truthy, so a value such as...

Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in qs

Summary Multiple vulnerabilities were addressed in IBM DataPower Gateway versions 11.0.0.3, 10.6.0.11, and 10.5.0.23 Vulnerability Details CVEID:CVE-2026-82417 DESCRIPTION: Summary qs.stringify throws a TypeError when it serializes an object whose own constructor property has a truthy, non-callab...

qs: qs: Denial of Service via improper validation in stringify function

A flaw was found in qs. The qs.stringify function, responsible for serializing objects, does not properly validate the isBuffer property of an object's constructor before attempting to invoke it. An unauthenticated attacker can provide specially crafted input that, when processed and then...

AZL-98334 CVE-2026-82417 affecting package nodejs-nodemon 2.0.3-5

Summary qs.stringify throws a TypeError when it serializes an object whose own constructor property has a truthy, non-callable isBuffer member. utils.isBuffer duck-types buffers by calling obj.constructor.isBufferobj after checking only that the property is truthy, so a value such as constructor:...

AZL-98397 CVE-2026-82417 affecting package python-tensorboard 2.16.2-6

Summary qs.stringify throws a TypeError when it serializes an object whose own constructor property has a truthy, non-callable isBuffer member. utils.isBuffer duck-types buffers by calling obj.constructor.isBufferobj after checking only that the property is truthy, so a value such as constructor:...

UBUNTU-CVE-2026-82417

Summary qs.stringify throws a TypeError when it serializes an object whose own constructor property has a truthy, non-callable isBuffer member. utils.isBuffer duck-types buffers by calling obj.constructor.isBufferobj after checking only that the property is truthy, so a value such as constructor:...

CVE-2026-82417

Summary qs.stringify throws a TypeError when it serializes an object whose own constructor property has a truthy, non-callable isBuffer member. utils.isBuffer duck-types buffers by calling obj.constructor.isBufferobj after checking only that the property is truthy, so a value such as constructor:...

CVE-2026-82417

Summary "qs.stringify" throws a "TypeError" when it serializes an object whose own "constructor" property has a truthy, non-callable "isBuffer" member. "utils.isBuffer" duck-types buffers by calling "obj.constructor.isBufferobj" after checking only that the property is truthy, so a value such as ...

PT-2026-83502

Name of the Vulnerable Software and Affected Versions qs versions 2.2.5 through 6.15.3 Description The qs.stringify function can throw a TypeError when serializing an object that contains a constructor property with a truthy, non-callable isBuffer member. This occurs because the utils.isBuffer...

Security Bulletin: Vulnerability in qs.stringify affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in qs.stringify has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...

qs: qs: Denial of Service due to improper handling of null/undefined array elements

A flaw was found in the qs library. When the qs.stringify function processes arrays containing null or undefined elements, and is configured with both arrayFormat: 'comma' and encodeValuesOnly: true, it can trigger a TypeError. This error causes the application to crash or return a 500 error,...

qs: qs: Denial of Service due to improper handling of null/undefined array elements

A flaw was found in the qs library. When the qs.stringify function processes arrays containing null or undefined elements, and is configured with both arrayFormat: 'comma' and encodeValuesOnly: true, it can trigger a TypeError. This error causes the application to crash or return a 500 error,...