Junglewise Threat Intelligence

CVE-2026-21710: Node.js denial of service via __proto__ header in req.headersDistinct

CVE-2026-21710 · Severity: high · CVSS 7.5 · Published 2026-03-30

Technologies: Red Hat Enterprise Linux AppStream, Node.js Foundation Node.Js. Vendors: Red Hat.

Executive brief

A vulnerability in Node.js can allow a remote attacker to crash a web server by sending a specially crafted web request. This occurs when the server receives a request containing a specific header name and attempts to process it, leading to an immediate application failure. This crash can disrupt business operations and result in a denial of service for customers and users.

Technical details

A vulnerability exists in the Node.js HTTP server implementation where processing a request header named '__proto__' leads to a synchronous TypeError. When an application accesses the 'req.headersDistinct' property, the internal logic attempts to resolve the header name against a destination object; because '__proto__' resolves to 'Object.prototype' instead of 'undefined', the engine attempts to call the '.push()' method on a non-array object. This exception occurs within a property getter and bypasses standard 'error' event listeners, resulting in an unhandled exception that crashes the Node.js process. The issue affects Node.js versions 20.x, 22.x, 24.x, and 25.x. Patches are available in Node.js v20.20.2, v22.22.2, v24.14.1, and v25.8.2.

Affected products

  • Node.js Foundation Node.js 20.x, 22.x, 24.x, 25.x
  • Red Hat Enterprise Linux AppStream 8, 9, 10

Timeline

  • 2026-03-24: advisory: Node.js security release published
  • 2026-03-24: patched: Fixed versions released (v20.20.2, v22.22.2, v24.14.1, v25.8.2)
  • 2026-03-30: disclosed: NVD publication date

References

Related threats