{"api_version":"1","generated_at":"2026-07-23T15:30:12+00:00","cve":"CVE-2026-21710","urls":{"html":"https://cve.report/CVE-2026-21710","api":"https://cve.report/api/cve/CVE-2026-21710.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-21710","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-21710"},"summary":{"title":"CVE-2026-21710","description":"A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.\r\n\r\nWhen this occurs, `dest[\"__proto__\"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`.\r\n\r\n* This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**","state":"PUBLISHED","assigner":"hackerone","published_at":"2026-03-30 20:16:18","updated_at":"2026-07-15 02:18:30"},"problem_types":["CWE-770","CWE-843","CWE-770 CWE-770 Allocation of Resources Without Limits or Throttling","CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')"],"metrics":[{"version":"3.1","source":"ADP","type":"CVSS","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}},{"version":"3.1","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.0","source":"support@hackerone.com","type":"Secondary","score":"7.5","severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.0","source":"CNA","type":"DECLARED","score":"7.5","severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.0"}}],"references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21710.json","name":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21710.json","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:7310","name":"https://access.redhat.com/errata/RHSA-2026:7310","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:7675","name":"https://access.redhat.com/errata/RHSA-2026:7675","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:7123","name":"https://access.redhat.com/errata/RHSA-2026:7123","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:8339","name":"https://access.redhat.com/errata/RHSA-2026:8339","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/security/cve/CVE-2026-21710","name":"https://access.redhat.com/security/cve/CVE-2026-21710","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:9711","name":"https://access.redhat.com/errata/RHSA-2026:9711","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:7983","name":"https://access.redhat.com/errata/RHSA-2026:7983","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:7896","name":"https://access.redhat.com/errata/RHSA-2026:7896","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:7350","name":"https://access.redhat.com/errata/RHSA-2026:7350","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:7302","name":"https://access.redhat.com/errata/RHSA-2026:7302","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:9874","name":"https://access.redhat.com/errata/RHSA-2026:9874","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:7670","name":"https://access.redhat.com/errata/RHSA-2026:7670","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://nodejs.org/en/blog/vulnerability/march-2026-security-releases","name":"https://nodejs.org/en/blog/vulnerability/march-2026-security-releases","refsource":"support@hackerone.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:7080","name":"https://access.redhat.com/errata/RHSA-2026:7080","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453151","name":"https://bugzilla.redhat.com/show_bug.cgi?id=2453151","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21710","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21710","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"nodejs","product":"node","version":"affected 20.20.1 20.20.1 semver","platforms":[]},{"source":"CNA","vendor":"nodejs","product":"node","version":"affected 22.22.1 22.22.1 semver","platforms":[]},{"source":"CNA","vendor":"nodejs","product":"node","version":"affected 24.14.0 24.14.0 semver","platforms":[]},{"source":"CNA","vendor":"nodejs","product":"node","version":"affected 25.8.1 25.8.1 semver","platforms":[]},{"source":"CNA","vendor":"nodejs","product":"node","version":"affected 4.0 4.* semver","platforms":[]},{"source":"CNA","vendor":"nodejs","product":"node","version":"affected 5.0 5.* semver","platforms":[]},{"source":"CNA","vendor":"nodejs","product":"node","version":"affected 6.0 6.* semver","platforms":[]},{"source":"CNA","vendor":"nodejs","product":"node","version":"affected 7.0 7.* semver","platforms":[]},{"source":"CNA","vendor":"nodejs","product":"node","version":"affected 8.0 8.* semver","platforms":[]},{"source":"CNA","vendor":"nodejs","product":"node","version":"affected 9.0 9.* semver","platforms":[]},{"source":"CNA","vendor":"nodejs","product":"node","version":"affected 10.0 10.* semver","platforms":[]},{"source":"CNA","vendor":"nodejs","product":"node","version":"affected 11.0 11.* semver","platforms":[]},{"source":"CNA","vendor":"nodejs","product":"node","version":"affected 12.0 12.* semver","platforms":[]},{"source":"CNA","vendor":"nodejs","product":"node","version":"affected 13.0 13.* semver","platforms":[]},{"source":"CNA","vendor":"nodejs","product":"node","version":"affected 14.0 14.* semver","platforms":[]},{"source":"CNA","vendor":"nodejs","product":"node","version":"affected 15.0 15.* semver","platforms":[]},{"source":"CNA","vendor":"nodejs","product":"node","version":"affected 16.0 16.* semver","platforms":[]},{"source":"CNA","vendor":"nodejs","product":"node","version":"affected 17.0 17.* semver","platforms":[]},{"source":"CNA","vendor":"nodejs","product":"node","version":"affected 18.0 18.* semver","platforms":[]},{"source":"CNA","vendor":"nodejs","product":"node","version":"affected 19.0 19.* semver","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","version":"unaffected 1:22.22.2-1.el10_1 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","version":"unaffected 1:24.14.1-2.el10_1 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","version":"unaffected 1:22.22.2-2.el10_0 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","version":"unaffected 8100020260331102257.6d880403 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","version":"unaffected 8100020260408131901.6d880403 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","version":"unaffected 8100020260414073138.489197e6 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","version":"unaffected 9070020260401095228.rhel9 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","version":"unaffected 9070020260402152654.rhel9 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","version":"unaffected 9070020260409073121.rhel9 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Extended Update Support","version":"unaffected 9040020260421133644.rhel9 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","version":"unaffected 9060020260409121057.rhel9 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","version":"unaffected 9060020260422064119.rhel9 * rpm","platforms":[]}],"timeline":[{"source":"ADP","time":"2026-03-30T20:01:21.196Z","lang":"en","value":"Reported to Red Hat."},{"source":"ADP","time":"2026-03-30T19:07:28.558Z","lang":"en","value":"Made public."}],"solutions":[{"source":"ADP","title":"","value":"RHSA-2026:7310: Red Hat Enterprise Linux AppStream EUS (v. 10.0)","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:7080: Red Hat Enterprise Linux AppStream (v. 10)","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:7675: Red Hat Enterprise Linux AppStream (v. 10)","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:8339: Red Hat Enterprise Linux AppStream (v. 8)","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:7123: Red Hat Enterprise Linux AppStream (v. 8)","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:7670: Red Hat Enterprise Linux AppStream (v. 8)","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:9711: Red Hat Enterprise Linux AppStream EUS (v.9.4)","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:9874: Red Hat Enterprise Linux AppStream EUS (v.9.6)","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:7983: Red Hat Enterprise Linux AppStream EUS (v.9.6)","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:7896: Red Hat Enterprise Linux AppStream (v. 9)","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:7302: Red Hat Enterprise Linux AppStream (v. 9)","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:7350: Red Hat Enterprise Linux AppStream (v. 9)","time":"","lang":"en"}],"workarounds":[{"source":"ADP","title":"","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.","time":"","lang":"en"}],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"21710","cve":"CVE-2026-21710","epss":"0.263560000","percentile":"0.977770000","score_date":"2026-07-18","updated_at":"2026-07-19 00:01:39"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-21710","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-03-31T13:55:20.665443Z","version":"2.0.3"},"type":"ssvc"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-770","description":"CWE-770 Allocation of Resources Without Limits or Throttling","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-03-31T13:55:23.719Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"},{"affected":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.1"],"defaultStatus":"affected","packageName":"nodejs22","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1:22.22.2-1.el10_1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.1"],"defaultStatus":"affected","packageName":"nodejs24","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1:24.14.1-2.el10_1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"defaultStatus":"affected","packageName":"nodejs22","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1:22.22.2-2.el10_0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"nodejs:22","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"8100020260331102257.6d880403","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"nodejs:24","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"8100020260408131901.6d880403","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"nodejs:20","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"8100020260414073138.489197e6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"nodejs:22","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"9070020260401095228.rhel9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"nodejs:24","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"9070020260402152654.rhel9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"nodejs:20","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"9070020260409073121.rhel9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.4"],"defaultStatus":"affected","packageName":"nodejs:20","product":"Red Hat Enterprise Linux 9.4 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"9040020260421133644.rhel9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6"],"defaultStatus":"affected","packageName":"nodejs:22","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"9060020260409121057.rhel9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6"],"defaultStatus":"affected","packageName":"nodejs:20","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"9060020260422064119.rhel9","versionType":"rpm"}]}],"datePublic":"2026-03-30T19:07:28.558Z","descriptions":[{"lang":"en","value":"A flaw was found in Node.js. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request that includes a header named `__proto__`. When a Node.js application processes this request and attempts to access distinct headers, it encounters an unhandled error, leading to an application crash. This can result in a Denial of Service (DoS), making the affected service unavailable to users."}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-843","description":"Access of Resource Using Incompatible Type ('Type Confusion')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-07-15T01:19:57.306Z","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","shortName":"redhat-SADP"},"references":[{"tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-21710"},{"name":"RHBZ#2453151","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453151"},{"tags":["x_sadp-csaf-vex"],"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21710.json"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:7310"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:7080"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:7675"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:8339"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:7123"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:7670"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:9711"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:9874"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:7983"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:7896"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:7302"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:7350"}],"solutions":[{"lang":"en","value":"RHSA-2026:7310: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"},{"lang":"en","value":"RHSA-2026:7080: Red Hat Enterprise Linux AppStream (v. 10)"},{"lang":"en","value":"RHSA-2026:7675: Red Hat Enterprise Linux AppStream (v. 10)"},{"lang":"en","value":"RHSA-2026:8339: Red Hat Enterprise Linux AppStream (v. 8)"},{"lang":"en","value":"RHSA-2026:7123: Red Hat Enterprise Linux AppStream (v. 8)"},{"lang":"en","value":"RHSA-2026:7670: Red Hat Enterprise Linux AppStream (v. 8)"},{"lang":"en","value":"RHSA-2026:9711: Red Hat Enterprise Linux AppStream EUS (v.9.4)"},{"lang":"en","value":"RHSA-2026:9874: Red Hat Enterprise Linux AppStream EUS (v.9.6)"},{"lang":"en","value":"RHSA-2026:7983: Red Hat Enterprise Linux AppStream EUS (v.9.6)"},{"lang":"en","value":"RHSA-2026:7896: Red Hat Enterprise Linux AppStream (v. 9)"},{"lang":"en","value":"RHSA-2026:7302: Red Hat Enterprise Linux AppStream (v. 9)"},{"lang":"en","value":"RHSA-2026:7350: Red Hat Enterprise Linux AppStream (v. 9)"}],"timeline":[{"lang":"en","time":"2026-03-30T20:01:21.196Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-03-30T19:07:28.558Z","value":"Made public."}],"title":"Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header","workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"node","vendor":"nodejs","versions":[{"lessThanOrEqual":"20.20.1","status":"affected","version":"20.20.1","versionType":"semver"},{"lessThanOrEqual":"22.22.1","status":"affected","version":"22.22.1","versionType":"semver"},{"lessThanOrEqual":"24.14.0","status":"affected","version":"24.14.0","versionType":"semver"},{"lessThanOrEqual":"25.8.1","status":"affected","version":"25.8.1","versionType":"semver"},{"lessThan":"4.*","status":"affected","version":"4.0","versionType":"semver"},{"lessThan":"5.*","status":"affected","version":"5.0","versionType":"semver"},{"lessThan":"6.*","status":"affected","version":"6.0","versionType":"semver"},{"lessThan":"7.*","status":"affected","version":"7.0","versionType":"semver"},{"lessThan":"8.*","status":"affected","version":"8.0","versionType":"semver"},{"lessThan":"9.*","status":"affected","version":"9.0","versionType":"semver"},{"lessThan":"10.*","status":"affected","version":"10.0","versionType":"semver"},{"lessThan":"11.*","status":"affected","version":"11.0","versionType":"semver"},{"lessThan":"12.*","status":"affected","version":"12.0","versionType":"semver"},{"lessThan":"13.*","status":"affected","version":"13.0","versionType":"semver"},{"lessThan":"14.*","status":"affected","version":"14.0","versionType":"semver"},{"lessThan":"15.*","status":"affected","version":"15.0","versionType":"semver"},{"lessThan":"16.*","status":"affected","version":"16.0","versionType":"semver"},{"lessThan":"17.*","status":"affected","version":"17.0","versionType":"semver"},{"lessThan":"18.*","status":"affected","version":"18.0","versionType":"semver"},{"lessThan":"19.*","status":"affected","version":"19.0","versionType":"semver"}]}],"descriptions":[{"lang":"en","value":"A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.\r\n\r\nWhen this occurs, `dest[\"__proto__\"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`.\r\n\r\n* This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**"}],"metrics":[{"cvssV3_0":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.0"}}],"providerMetadata":{"dateUpdated":"2026-03-30T19:07:28.558Z","orgId":"36234546-b8fa-4601-9d6f-f4e334aa8ea1","shortName":"hackerone"},"references":[{"url":"https://nodejs.org/en/blog/vulnerability/march-2026-security-releases"}]}},"cveMetadata":{"assignerOrgId":"36234546-b8fa-4601-9d6f-f4e334aa8ea1","assignerShortName":"hackerone","cveId":"CVE-2026-21710","datePublished":"2026-03-30T19:07:28.558Z","dateReserved":"2026-01-04T15:00:06.574Z","dateUpdated":"2026-07-15T01:19:57.306Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-03-30 20:16:18","lastModifiedDate":"2026-07-15 02:18:30","problem_types":["CWE-770","CWE-843","CWE-770 CWE-770 Allocation of Resources Without Limits or Throttling","CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')"],"metrics":{"cvssMetricV31":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV30":[{"source":"support@hackerone.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-31T13:55:20.665443Z","id":"CVE-2026-21710","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"21710","Ordinal":"1","Title":"CVE-2026-21710","CVE":"CVE-2026-21710","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"21710","Ordinal":"1","NoteData":"A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.\r\n\r\nWhen this occurs, `dest[\"__proto__\"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`.\r\n\r\n* This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**","Type":"Description","Title":"CVE-2026-21710"}]}}}