Detections
Analytics

Echo: qs: security update to 6.16.0

medium Tenable Cloud Security Plugin ID 461590

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - ### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor`
 property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling
 `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{
 constructor: { isBuffer: "x" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a
 function`. ### Details `lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it
 serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without
 verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object
 carrying them as own properties reaches the unchecked call. Such an object can be built from untrusted
 input. `qs.parse("x[constructor][isBuffer]=y", { plainObjects: true })` or `{ allowPrototypes: true }`
 keeps the `constructor` key as an own property (the default parse options drop it), and
 `JSON.parse("{\"a\":{\"constructor\":{\"isBuffer\":\"x\"}}}")` produces the same shape with no qs option
 involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both
 call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the
 shape directly. #### PoC ```js var qs = require("qs"); qs.stringify(qs.parse("x[constructor][isBuffer]=y",
 { plainObjects: true })); qs.stringify(JSON.parse("{\"a\":{\"constructor\":{\"isBuffer\":\"x\"}}}")); //
 TypeError: obj.constructor.isBuffer is not a function // at Object.isBuffer (lib/utils.js:332:78) // at
 stringify (lib/stringify.js:127:45) ``` #### Fix `lib/utils.js`, applied in e83d321 on `main` and released
 as v6.16.0: ```diff - return !!(obj.constructor && obj.constructor.isBuffer &&
 obj.constructor.isBuffer(obj)); + return !!(obj.constructor && typeof obj.constructor.isBuffer ===
 "function" && obj.constructor.isBuffer(obj)); ``` Real `Buffer`, `safer-buffer`, and browserify `buffer`
 polyfill instances serialize exactly as before; only the throw is removed. ### Affected versions `>=2.2.5
 <6.16.0`, fixed in v6.16.0. The unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5
 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from
 v2.2.5 through v6.15.3 contains the unguarded call. ### Impact An unauthenticated request can make any
 code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query
 string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw
 synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and
 the affected request returns a 500; the process survives and other requests are unaffected. Where the call
 runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled
 promise rejection) or a background job, the process exits, so the impact in that case depends on the
 application error handling rather than on qs. (CVE-2026-82417)

Solution

Update the qs library and its related packages to version 6.16.0 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-82417

Plugin Details

Severity: Medium

ID: 461590

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/3/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2026-82417

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.3

Threat Score: 1.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/28/2026

Vulnerability Publication Date: 8/29/2026

Reference Information

CVE: CVE-2026-82417