V8’s string hashing routine treats integer‑like strings as their numeric value, which forces many distinct strings to map to the same hash bucket. An attacker who supplies specially crafted JSON containing many such strings can cause a large number of hash collisions in the internal string table. The resulting overhead drains CPU and memory, slowing or halting the Node.js process and effectively denying service to legitimate users.

Versions 20.x, 22.x, 24.x, and 25.x of the Node.js runtime are affected. Any application running those releases that parses JSON from external input – for example via JSON.parse on an HTTP request body – is vulnerable.

The CVSS score of 5.9 indicates a moderate severity. No exploitation campaigns have been reported and the directive is not listed in CISA’s Known Exploited Vulnerabilities catalog. EPSS information is not available. An attacker needs only to send crafted JSON to any endpoint that performs JSON.parse; elevated privileges are not required. Successful exploitation manifests as degraded performance, increased latency, or complete unavailability of the Node.js service, without leaking data or escalating privileges.