AIKIDO-2026-81971

TL;DR

The utils.isBuffer helper duck-types buffers by reading obj.constructor.isBuffer and invoking it after only checking that the property is truthy. Parsing untrusted input with plainObjects or allowPrototypes can produce an object whose constructor.isBuffer is a truthy non-callable value, so a later stringify call invokes a non-function and throws an uncaught TypeError. The exception aborts serialization of externally influenced data and can crash the request handler or worker process when it runs outside an error boundary. The fix verifies that constructor.isBuffer is a function before calling it.