CVE-2026-21710 - Vulnerability Details

- Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header

Description

A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.

When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`.

* This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**

Published: 2026-03-30

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in Node.js HTTP request handling results in an uncaught TypeError when a request containing the header __proto__ is processed and the application reads req.headersDistinct. The exception occurs synchronously within a property getter and cannot be caught by standard error handlers, leading to an unpredictable crash of the Node.js process. This failure causes a denial of service in affected applications.

Affected Systems

The vulnerability affects all Node.js HTTP servers running on the 20.x, 22.x, 24.x, and v25.x branches. In production environments, any application that relies on the default HTTP module and accesses request headers via req.headersDistinct is susceptible.

Risk and Exploitability

The CVSS score of 7.5 indicates medium to high severity, while the EPSS score of less than 1% suggests that exploitation is unlikely to be widely automated. The flaw is not listed in the CISA KEV catalog. Attackers can trigger the crash by sending a crafted HTTP request over the network to a vulnerable Node.js server; the vector is inferred from the HTTP header manipulation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

nodejs

node

unaffected

Version	Status	Constraints
`20.20.1`	affected	≤ 20.20.1
`22.22.1`	affected	≤ 22.22.1
`24.14.0`	affected	≤ 24.14.0
`25.8.1`	affected	≤ 25.8.1
`4.0`	affected	< 4.*
`5.0`	affected	< 5.*
`6.0`	affected	< 6.*
`7.0`	affected	< 7.*
`8.0`	affected	< 8.*
`9.0`	affected	< 9.*
`10.0`	affected	< 10.*
`11.0`	affected	< 11.*
`12.0`	affected	< 12.*
`13.0`	affected	< 13.*
`14.0`	affected	< 14.*
`15.0`	affected	< 15.*
`16.0`	affected	< 16.*
`17.0`	affected	< 17.*
`18.0`	affected	< 18.*
`19.0`	affected	< 19.*

No data.

Vendor Product Confidence Versions

Nodejs

92%

Version	Status	Scheme	Platform
`[20.20.1,20.20.1]`	affected	semver	—
`[22.22.1,22.22.1]`	affected	semver	—
`[24.14.0,24.14.0]`	affected	semver	—
`[25.8.1,25.8.1]`	affected	semver	—
`[4.0.0,5.0.0)`	affected	semver	—
`[5.0.0,6.0.0)`	affected	semver	—
`[6.0.0,7.0.0)`	affected	semver	—
`[7.0.0,8.0.0)`	affected	semver	—
`[8.0.0,9.0.0)`	affected	semver	—
`[9.0.0,10.0.0)`	affected	semver	—
`[10.0.0,11.0.0)`	affected	semver	—
`[11.0.0,12.0.0)`	affected	semver	—
`[12.0.0,13.0.0)`	affected	semver	—
`[13.0.0,14.0.0)`	affected	semver	—
`[14.0.0,15.0.0)`	affected	semver	—
`[15.0.0,16.0.0)`	affected	semver	—
`[16.0.0,17.0.0)`	affected	semver	—
`[17.0.0,18.0.0)`	affected	semver	—
`[18.0.0,19.0.0)`	affected	semver	—
`[19.0.0,20.0.0)`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to the latest Node.js release that includes the March 2026 security fix (e.g., continue patch series 20.x, 22.x, 24.x, or v25.x).
If immediate upgrade cannot be performed, wrap all accesses to req.headersDistinct in try/catch blocks to avoid unhandled exceptions.
Validate incoming request headers to reject or sanitize __proto__ headers before processing.
Monitor application logs for uncaught TypeError exceptions and ensure the service restarts gracefully.

Generated by OpenCVE AI on April 1, 2026 at 05:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6183-1	nodejs security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00031.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://nodejs.org/en/blog/vulnerability/march-2026-security-releases
https://nvd.nist.gov/vuln/detail/CVE-2026-21710
https://www.cve.org/CVERecord?id=CVE-2026-21710

History

Wed, 01 Apr 2026 02:15:00 +0000

Type	Values Removed	Values Added
Title	Unhandled TypeError from __proto__ Header in Node.js HTTP Request Handling	Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header
First Time appeared		Nodejs Nodejs nodejs
Weaknesses	CWE-20	CWE-843
Vendors & Products		Nodejs Nodejs nodejs
References		https://nvd.nist.gov/vuln/detail/CVE-2026-21710 https://www.cve.org/CVERecord?id=CVE-2026-21710
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Tue, 31 Mar 2026 14:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-770
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 31 Mar 2026 03:00:00 +0000

Type	Values Removed	Values Added
Title		Unhandled TypeError from __proto__ Header in Node.js HTTP Request Handling
Weaknesses		CWE-20

Mon, 30 Mar 2026 19:30:00 +0000

Type	Values Removed	Values Added
Description		A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on 20.x, 22.x, 24.x, and v25.x
References		https://nodejs.org/en/blog/vulnerability/march-2026-security-releases
Metrics		cvssV3_0 `{'score': 7.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Subscriptions

Nodejs Nodejs

MITRE

Status: PUBLISHED

Assigner: hackerone

Published: 2026-03-30T19:07:28.558Z

Updated: 2026-03-31T13:55:23.719Z

Reserved: 2026-01-04T15:00:06.574Z

Link: CVE-2026-21710

Vulnrichment

Updated: 2026-03-31T13:55:13.442Z

NVD

Status : Awaiting Analysis

Published: 2026-03-30T20:16:18.210

Modified: 2026-04-01T14:24:21.833

Link: CVE-2026-21710

Redhat

Severity : Important

Publid Date: 2026-03-30T19:07:28Z

Links: CVE-2026-21710 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-02T07:54:00Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object