THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-82417 (MEDIUM 5.3) — ### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is t

[NVD] CVE-2026-82417 (MEDIUM 5.3) — ### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is t

mednvdPublished 2026-08-30

CVE-2026-82417 CVSS: 5.3 MEDIUM Published: 2026-08-30T00:16:34.657

### Summary

`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer

Indicators of compromise

CVE-2026-82417cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-82417