The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor`     property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling     `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{     constructor: { isBuffer: x } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a     function`. ### Details `lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it     serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without     verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object     carrying them as own properties reaches the unchecked call. Such an object can be built from untrusted     input. `qs.parse(x[constructor][isBuffer]=y, { plainObjects: true })` or `{ allowPrototypes: true }`     keeps the `constructor` key as an own property (the default parse options drop it), and     `JSON.parse({\a\:{\constructor\:{\isBuffer\:\x\}}})` produces the same shape with no qs option     involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both     call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the     shape directly. #### PoC ```js var qs = require(qs); qs.stringify(qs.parse(x[constructor][isBuffer]=y,     { plainObjects: true })); qs.stringify(JSON.parse({\a\:{\constructor\:{\isBuffer\:\x\}}})); //     TypeError: obj.constructor.isBuffer is not a function // at Object.isBuffer (lib/utils.js:332:78) // at     stringify (lib/stringify.js:127:45) ``` #### Fix `lib/utils.js`, applied in e83d321 on `main` and released     as v6.16.0: ```diff - return !!(obj.constructor && obj.constructor.isBuffer &&     obj.constructor.isBuffer(obj)); + return !!(obj.constructor && typeof obj.constructor.isBuffer ===     function && obj.constructor.isBuffer(obj)); ``` Real `Buffer`, `safer-buffer`, and browserify `buffer`     polyfill instances serialize exactly as before; only the throw is removed. ### Affected versions `>=2.2.5     <6.16.0`, fixed in v6.16.0. The unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5     (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from     v2.2.5 through v6.15.3 contains the unguarded call. ### Impact An unauthenticated request can make any     code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query     string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw     synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and     the affected request returns a 500; the process survives and other requests are unaffected. Where the call     runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled     promise rejection) or a background job, the process exits, so the impact in that case depends on the     application error handling rather than on qs. (CVE-2026-82417)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-82417

medium Nessus Plugin ID 341603

Version 1.12

Version 1.11

Version 1.10

Version 1.9

Version 1.8

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.12 Sep 17, 2026, 12:32 PM CVSS metrics ("CVSSv2 score" set to 5.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P") CVSSv2 severity (based on CVE-2026-82417, severity decreased from "High" to "Medium") Plugin Feed: 202609171232
Version 1.11 Sep 16, 2026, 5:33 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609160533
Version 1.10 Sep 11, 2026, 3:58 AM CVSS metrics ("CVSSv2 score" set to 7.5) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P") CVSSv2 severity (based on CVE-2026-82417, severity increased from "Medium" to "High") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609110358
Version 1.9 Sep 10, 2026, 3:20 PM CVSS metrics ("CVSSv2 score" set to 5.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P") CVSSv2 severity (based on CVE-2026-82417, severity decreased from "High" to "Medium") Plugin Feed: 202609101520
Version 1.8 Sep 7, 2026, 2:57 PM CVSS metrics ("CVSSv2 score" set to 7.5. "Cvssv4 threat score" set to 6.3. "CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P") CVSSv2 severity (based on CVE-2026-82417, severity decreased from "High" to "Medium". based on CVE-2026-82417, severity increased from "Medium" to "High") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609071457
Version 1.6 Sep 4, 2026, 7:34 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609040734
Version 1.5 Sep 3, 2026, 6:34 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609031834
Version 1.4 Sep 2, 2026, 11:39 PM CVSS metrics ("CVSSv2 score" set to 7.5) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P") CVSSv2 severity (based on CVE-2026-82417, severity increased from "Medium" to "High") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609022339
Version 1.3 Sep 2, 2026, 11:53 AM CVSS metrics ("CVSSv2 score" set to 5.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P") CVSSv2 severity (based on CVE-2026-82417, severity decreased from "High" to "Medium") Plugin Feed: 202609021153
Version 1.2 Sep 1, 2026, 5:14 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609010514
Version 1.1 Aug 30, 2026, 4:32 PM New Plugin Feed: 202608301632