qs CVE-2026-82417

Two conditions must both be satisfied. First, attacker-controlled data must reach a parsed object that retains the constructor key as an own property: this occurs when qs.parse is called with plainObjects: true or allowPrototypes: true (Express 4 default query-parser and body-parser with extended: true satisfy this with no non-default application configuration), or when a matching shape is introduced via JSON.parse from an attacker-supplied JSON body (no qs option involved). Default qs.parse options silently drop the constructor key and are not affected. Second, that parsed object must subsequently be passed to qs.stringify - typically in a code path that reconstructs a query string for a redirect or upstream HTTP call. Impact severity depends on calling context: inside a synchronous Express error boundary the process survives and returns HTTP 500; inside an async handler or background job the throw becomes an unhandled rejection and may terminate the process.

The CVSS 4.0 score of 6.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VA:L) accurately reflects moderate real-world risk bounded by a critical application-level precondition: the target application must re-serialize attacker-influenced data with qs.stringify. AT:P (Attack Requirements: Present) captures this prerequisite. However, the named triggering stacks - Express 4 with default settings and body-parser with extended: true - are among the most common Node.js HTTP configurations in production, meaningfully widening the realistic attack surface beyond what AT:P alone suggests. No EPSS score was provided, so exploitation probability cannot be quantified from available data. POC is confirmed (embedded in the advisory), and exploitation is trivial once conditions are met. Active exploitation via CISA KEV is not confirmed. Impact is bounded: in most Express error boundaries the throw produces a 500 and the process survives; in async handlers or background jobs, an unhandled rejection can terminate the process, making worst-case impact a service outage. No confidentiality or integrity exposure exists - the 'Information Disclosure' tag in the source intelligence is incorrect and directly contradicted by the CVSS vector (VC:N/VI:N).

An attacker sends a POST request to an Express 4 application using body-parser with extended: true, with a JSON body such as {"a":{"constructor":{"isBuffer":"x"}}}. The framework parses this with allowPrototypes: true, placing the malicious shape in req.body. When the handler calls qs.stringify(req.body) to rebuild a query string for an upstream redirect, utils.isBuffer attempts to invoke the string "x" as a function, throwing a TypeError. In an async handler this becomes an unhandled promise rejection, crashing the Node.js process. A working PoC demonstrating this is included in the CVE description.