CVE-2026-82417 | CVSS: 5.3 | 严重级别: MEDIUM
### Summary
`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: "x" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.
### Details
`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer`
参考链接:
• https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6
• https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g
📌 数据来源: NVD 官方