CVE-2026-21710 - Vulnerability Details

Description

A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.

When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`.

* This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**

Published: 2026-03-30

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in Node.js HTTP request processing causes an uncaught TypeError when a client sends a header named __proto__. The faulty code resolves dest["__proto__"] to Object.prototype and attempts to call .push() on it, leading to a synchronous exception that cannot be caught by standard error handlers. This results in the Node.js process terminating, causing the application to crash and denying service to all users. The vulnerability stems from input validation weakness and improper handling of prototype properties.

Affected Systems

It impacts all Node.js HTTP servers running on versions 20.x, 22.x, 24.x, and v25.x. The affected product is Node.js, provided by the nodejs:node vendor.

Risk and Exploitability

The CVSS score of 7.5 classifies the issue as high severity, but the EPSS score of less than 1 percent indicates exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger it remotely by sending a crafted HTTP request containing the __proto__ header, resulting in a crash that would disrupt service availability.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

nodejs

node

unaffected

Version	Status	Constraints
`20.20.1`	affected	≤ 20.20.1
`22.22.1`	affected	≤ 22.22.1
`24.14.0`	affected	≤ 24.14.0
`25.8.1`	affected	≤ 25.8.1
`4.0`	affected	< 4.*
`5.0`	affected	< 5.*
`6.0`	affected	< 6.*
`7.0`	affected	< 7.*
`8.0`	affected	< 8.*
`9.0`	affected	< 9.*
`10.0`	affected	< 10.*
`11.0`	affected	< 11.*
`12.0`	affected	< 12.*
`13.0`	affected	< 13.*
`14.0`	affected	< 14.*
`15.0`	affected	< 15.*
`16.0`	affected	< 16.*
`17.0`	affected	< 17.*
`18.0`	affected	< 18.*
`19.0`	affected	< 19.*

No data.

Vendor Product Confidence Versions

Nodejs

92%

Version	Status	Scheme	Platform
`[20.20.1,20.20.1]`	affected	semver	—
`[22.22.1,22.22.1]`	affected	semver	—
`[24.14.0,24.14.0]`	affected	semver	—
`[25.8.1,25.8.1]`	affected	semver	—
`[4.0.0,5.0.0)`	affected	semver	—
`[5.0.0,6.0.0)`	affected	semver	—
`[6.0.0,7.0.0)`	affected	semver	—
`[7.0.0,8.0.0)`	affected	semver	—
`[8.0.0,9.0.0)`	affected	semver	—
`[9.0.0,10.0.0)`	affected	semver	—
`[10.0.0,11.0.0)`	affected	semver	—
`[11.0.0,12.0.0)`	affected	semver	—
`[12.0.0,13.0.0)`	affected	semver	—
`[13.0.0,14.0.0)`	affected	semver	—
`[14.0.0,15.0.0)`	affected	semver	—
`[15.0.0,16.0.0)`	affected	semver	—
`[16.0.0,17.0.0)`	affected	semver	—
`[17.0.0,18.0.0)`	affected	semver	—
`[18.0.0,19.0.0)`	affected	semver	—
`[19.0.0,20.0.0)`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the Node.js security update released in March 2026 for affected versions 20.x, 22.x, 24.x, and v25.x.
Restart the Node.js application after upgrading to ensure the patch is in effect.
If the update cannot be applied immediately, block or remove the __proto__ header in inbound HTTP requests using a reverse proxy or firewall.
Review application code to eliminate or wrap accesses to req.headersDistinct so that errors are caught and do not crash the process.

Generated by OpenCVE AI on March 31, 2026 at 15:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6183-1	nodejs security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00014.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://nodejs.org/en/blog/vulnerability/march-2026-security-releases
https://nvd.nist.gov/vuln/detail/CVE-2026-21710
https://www.cve.org/CVERecord?id=CVE-2026-21710

History

Wed, 01 Apr 2026 02:15:00 +0000

Type	Values Removed	Values Added
Title	Unhandled TypeError from __proto__ Header in Node.js HTTP Request Handling	Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header
First Time appeared		Nodejs Nodejs nodejs
Weaknesses	CWE-20	CWE-843
Vendors & Products		Nodejs Nodejs nodejs
References		https://nvd.nist.gov/vuln/detail/CVE-2026-21710 https://www.cve.org/CVERecord?id=CVE-2026-21710
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Tue, 31 Mar 2026 14:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-770
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 31 Mar 2026 03:00:00 +0000

Type	Values Removed	Values Added
Title		Unhandled TypeError from __proto__ Header in Node.js HTTP Request Handling
Weaknesses		CWE-20

Mon, 30 Mar 2026 19:30:00 +0000

Type	Values Removed	Values Added
Description		A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on 20.x, 22.x, 24.x, and v25.x
References		https://nodejs.org/en/blog/vulnerability/march-2026-security-releases
Metrics		cvssV3_0 `{'score': 7.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Subscriptions

Nodejs Nodejs

MITRE

Status: PUBLISHED

Assigner: hackerone

Published: 2026-03-30T19:07:28.558Z

Updated: 2026-03-31T13:55:23.719Z

Reserved: 2026-01-04T15:00:06.574Z

Link: CVE-2026-21710

Vulnrichment

Updated: 2026-03-31T13:55:13.442Z

NVD

Status : Received

Published: 2026-03-30T20:16:18.210

Modified: 2026-03-31T15:16:11.700

Link: CVE-2026-21710

Redhat

Severity : Important

Publid Date: 2026-03-30T19:07:28Z

Links: CVE-2026-21710 - Bugzilla

OpenCVE Enrichment

Updated: 2026-03-31T20:40:22Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object