https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 06:26:46 +0000 https://vulnerability.circl.lu/vuln/cve-2026-82417 <p><strong>Affected:</strong> ljharb qs</p> <p>### Summary</p> <p>`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: &#34;x&#34; } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.</p> <p>### Details</p> <p>`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.</p> <p>Such an object can be built from untrusted input. `qs.parse(&#34;x[constructor][isBuffer]=y&#34;, { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(&#34;{\&#34;a\&#34;:{\&#34;constructor\&#34;:{\&#34;isBuffer\&#34;:\&#34;x\&#34;}}}&#34;)` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.</p> <p>#### PoC</p> <p>```js</p> <p>var qs = require(&#34;qs&#34;);</p> <p>qs.stringify(qs.parse(&#34;x[constructor][isBuffer]=y&#34;, { plainObjects: true }));</p> <p>qs.stringify…</p> <p><strong>Affected:</strong> ljharb qs</p> <p>### Summary</p> <p>`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: &#34;x&#34; } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.</p> <p>### Details</p> <p>`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.</p> <p>Such an object can be built from untrusted input. `qs.parse(&#34;x[constructor][isBuffer]=y&#34;, { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(&#34;{\&#34;a\&#34;:{\&#34;constructor\&#34;:{\&#34;isBuffer\&#34;:\&#34;x\&#34;}}}&#34;)` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.</p> <p>#### PoC</p> <p>```js</p> <p>var qs = require(&#34;qs&#34;);</p> <p>qs.stringify(qs.parse(&#34;x[constructor][isBuffer]=y&#34;, { plainObjects: true }));</p> <p>qs.stringify…</p> https://vulnerability.circl.lu/vuln/cve-2026-82417