Executive brief
A vulnerability in the Node.js JavaScript engine allows attackers to cause significant performance slowdowns or a denial-of-service state. By sending specially crafted data to an application—most commonly through standard JSON inputs—an attacker can trigger internal processing conflicts that consume excessive CPU resources. This can lead to unresponsive applications and disrupted services for legitimate users.
Technical details
A flaw exists in V8's string hashing mechanism where integer-like strings are hashed to their numeric values, making hash collisions predictable. An attacker can exploit this by crafting requests that cause numerous collisions within V8's internal string table, leading to a Hash Denial of Service (HashDoS). The vulnerability is most easily triggered via endpoints that use `JSON.parse()` on attacker-controlled input, as this process automatically internalizes short strings into the vulnerable hash table. This affects Node.js versions 20.x, 22.x, 24.x, and 25.x. Patches are available in Node.js v20.20.2, v22.22.2, v24.14.1, and v25.8.2.
Affected products
- Node.js Node.js 20.x, 22.x, 24.x, 25.x
Timeline
- 2026-03-24: patched: Security releases v20.20.2, v22.22.2, v24.14.1, and v25.8.2 published.
- 2026-03-30: disclosed: CVE-2026-21717 published.