CVE-2026-21712: A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized

Executive brief

Node.js is a popular runtime environment used to build and run network applications. A flaw in how it handles internationalized web addresses can be triggered to crash the application. This results in a denial-of-service, potentially disrupting business operations and service availability.

Technical details

An assertion failure exists within the 'node_url.cc' component of Node.js. The vulnerability is triggered when the 'url.format()' function processes a malformed Internationalized Domain Name (IDN) that contains invalid characters. Because this occurs in native code, the resulting assertion failure causes an immediate crash of the Node.js process (Denial of Service). The issue affects Node.js versions 24.x and 25.x. Security updates were released in March 2026 to address this flaw.

Affected products

• Node.js Node.js 24.x, 25.x

Timeline

• 2026-03-24: patched: Security releases for 24.x and 25.x made available.
• 2026-03-30: disclosed: Initial NVD publication.

References

• https://hackerone.com/reports/3546390
• https://nodejs.org/en/blog/vulnerability/march-2026-security-releases