A flaw in Node.js causes an assertion failure within the native code when its url.format() function processes a malformed internationalized domain name containing invalid characters. The assertion triggers a crash of the Node.js process, resulting in an availability loss for the application but does not directly expose confidentiality or integrity vulnerabilities.

The vulnerability is present in the Node.js runtime itself, i.e., the nodejs:node product. Because no specific version range is supplied, all Node.js releases that include the affected url.format() implementation are potentially impacted until the March 2026 security updates are applied.

With a CVSS score of 5.7 the flaw is considered moderate in severity. Exploitation requires an attacker to supply a specially crafted malformed IDN to a Node.js application that calls url.format(), after which the application process terminates deterministically. No remote code execution or data compromise is reported, yet a crash can be leveraged for denial‑of‑service attacks. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, so the risk remains moderate but actionable.