# CVE-2026-21710: Node.js denial of service via __proto__ header in req.headersDistinct

Source: https://junglewise.ai/threats/cve-2026-21710-node-js-denial-of-service-via-proto-header-in-req-headersdistinct  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-30. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-21710 · Severity: high · CVSS 7.5 · Published 2026-03-30

A vulnerability in Node.js can allow a remote attacker to crash a web server by sending a specially crafted web request. This occurs when the server receives a request containing a specific header name and attempts to process it, leading to an immediate application failure. This crash can disrupt business operations and result in a denial of service for customers and users.

Technologies: [Red Hat Enterprise Linux AppStream](https://junglewise.ai/threats/technologies/enterprise-linux-appstream). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-21710 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-21710 being exploited in the wild.

**How severe is CVE-2026-21710?** High severity, with a CVSS score of 7.5, published 30 March 2026.

**Which products and versions are affected?** Red Hat Enterprise Linux AppStream 8, 9, 10.

**Is there a fix for CVE-2026-21710?** A patch was published on 2026-03-24: Fixed versions released (v20.20.2, v22.22.2, v24.14.1, v25.8.2) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-21710 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-21710?** Check whether you run Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the Node.js HTTP server implementation where processing a request header named '__proto__' leads to a synchronous TypeError. When an application accesses the 'req.headersDistinct' property, the internal logic attempts to resolve the header name against a destination object; because '__proto__' resolves to 'Object.prototype' instead of 'undefined', the engine attempts to call the '.push()' method on a non-array object. This exception occurs within a property getter and bypasses standard 'error' event listeners, resulting in an unhandled exception that crashes the Node.js process. The issue affects Node.js versions 20.x, 22.x, 24.x, and 25.x. Patches are available in Node.js v20.20.2, v22.22.2, v24.14.1, and v25.8.2.

## Affected products

- Node.js Foundation Node.js 20.x, 22.x, 24.x, 25.x
- Red Hat Enterprise Linux AppStream 8, 9, 10

## Timeline

- 2026-03-24: advisory: Node.js security release published
- 2026-03-24: patched: Fixed versions released (v20.20.2, v22.22.2, v24.14.1, v25.8.2)
- 2026-03-30: disclosed: NVD publication date

## References

- [https://nodejs.org/en/blog/vulnerability/march-2026-security-releases](https://nodejs.org/en/blog/vulnerability/march-2026-security-releases)
- [https://access.redhat.com/errata/RHSA-2026:7080](https://access.redhat.com/errata/RHSA-2026:7080)
- [https://access.redhat.com/errata/RHSA-2026:7123](https://access.redhat.com/errata/RHSA-2026:7123)
- [https://access.redhat.com/errata/RHSA-2026:7302](https://access.redhat.com/errata/RHSA-2026:7302)
- [https://access.redhat.com/errata/RHSA-2026:7310](https://access.redhat.com/errata/RHSA-2026:7310)
- [https://access.redhat.com/errata/RHSA-2026:7350](https://access.redhat.com/errata/RHSA-2026:7350)
- [https://access.redhat.com/errata/RHSA-2026:7670](https://access.redhat.com/errata/RHSA-2026:7670)

## Related threats

- [CESNET libyang heap buffer overflow in lyb_read_string](https://junglewise.ai/threats/cve-2026-44673-cesnet-libyang-heap-buffer-overflow-in-lyb-read-string)
- [dnsmasq heap out-of-bounds read in extract_addresses](https://junglewise.ai/threats/cve-2026-5172-dnsmasq-heap-out-of-bounds-read-in-extract-addresses)
- [dnsmasq heap out-of-bounds read in DNSSEC validation](https://junglewise.ai/threats/cve-2026-4891-dnsmasq-heap-out-of-bounds-read-in-dnssec-validation)
- [dnsmasq infinite loop in DNSSEC NSEC parsing](https://junglewise.ai/threats/cve-2026-4890-dnsmasq-infinite-loop-in-dnssec-nsec-parsing)
- [PHP DOMNode::C14N() denial of service via circular linked list](https://junglewise.ai/threats/cve-2026-7263-php-domnode-c14n-denial-of-service-via-circular-linked-list)