[GHSA] GHSA-4mjr-xmp4-gh2g (medium) — qs: Denial of Service via Attacker Controlled isBuffer

GHSA-4mjr-xmp4-gh2g Severity: medium CVE: CVE-2026-82417

qs: Denial of Service via Attacker Controlled isBuffer

### Summary

`qs.stringify()` calls `utils.isBuffer()` on every value it serializes, and `utils.isBuffer()` invokes `obj.constructor.isBuffer(obj)` without checking that it is callable. A value whose own `constructor.isBuffer` is a non-function makes `qs` call a non-callable and throw