CVE-2026-21710
- Source
- https://cve.org/CVERecord?id=CVE-2026-21710
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21710.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-21710
- Aliases
- Downstream
- Related
- Published
- 2026-03-30T19:07:28Z
- Modified
- 2026-08-21T03:46:35Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
A flaw in Node.js HTTP request handling causes an uncaught
TypeErrorwhen a request is received with a header named__proto__and the application accessesreq.headersDistinct.When this occurs,
dest["__proto__"]resolves toObject.prototyperather thanundefined, causing.push()to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted byerrorevent listeners, meaning it cannot be handled without wrapping everyreq.headersDistinctaccess in atry/catch.- This vulnerability affects all Node.js HTTP servers on 20.x, 22.x, 24.x, and v25.x
- Database specific
{ "cna_assigner": "hackerone", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21710.json", "unresolved_ranges": [ { "extracted_events": [ { "introduced": "20.20.1" }, { "last_affected": "20.20.1" }, { "introduced": "22.22.1" }, { "last_affected": "22.22.1" }, { "introduced": "24.14.0" }, { "last_affected": "24.14.0" }, { "introduced": "25.8.1" }, { "last_affected": "25.8.1" }, { "introduced": "4.0" }, { "fixed": "4.*" }, { "introduced": "5.0" }, { "fixed": "5.*" }, { "introduced": "6.0" }, { "fixed": "6.*" }, { "introduced": "7.0" }, { "fixed": "7.*" }, { "introduced": "8.0" }, { "fixed": "8.*" }, { "introduced": "9.0" }, { "fixed": "9.*" }, { "introduced": "10.0" }, { "fixed": "10.*" }, { "introduced": "11.0" }, { "fixed": "11.*" }, { "introduced": "12.0" }, { "fixed": "12.*" }, { "introduced": "13.0" }, { "fixed": "13.*" }, { "introduced": "14.0" }, { "fixed": "14.*" }, { "introduced": "15.0" }, { "fixed": "15.*" }, { "introduced": "16.0" }, { "fixed": "16.*" }, { "introduced": "17.0" }, { "fixed": "17.*" }, { "introduced": "18.0" }, { "fixed": "18.*" }, { "introduced": "19.0" }, { "fixed": "19.*" } ], "source": "AFFECTED_FIELD" } ] }- References
-
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21710.json
- https://access.redhat.com/errata/RHSA-2026:7080
- https://access.redhat.com/errata/RHSA-2026:7123
- https://access.redhat.com/errata/RHSA-2026:7302
- https://access.redhat.com/errata/RHSA-2026:7310
- https://access.redhat.com/errata/RHSA-2026:7350
- https://access.redhat.com/errata/RHSA-2026:7670
- https://access.redhat.com/errata/RHSA-2026:7675
- https://access.redhat.com/errata/RHSA-2026:7896
- https://access.redhat.com/errata/RHSA-2026:7983
- https://access.redhat.com/errata/RHSA-2026:8339
- https://access.redhat.com/errata/RHSA-2026:9711
- https://access.redhat.com/errata/RHSA-2026:9874
- https://access.redhat.com/security/cve/CVE-2026-21710
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21710.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-21710
- https://bugzilla.redhat.com/show_bug.cgi?id=2453151
- https://nodejs.org/en/blog/vulnerability/march-2026-security-releases
Affected packages
Git / github.com/nodejs/node
Affected ranges
- Type
- GIT
- Repo
- https://github.com/nodejs/node
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast AffectedIntroducedLast AffectedIntroducedLast AffectedIntroducedLast Affected
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "extracted_events": [ { "introduced": "0" }, { "last_affected": "20.20.1" }, { "introduced": "22.0.0" }, { "last_affected": "22.22.1" }, { "introduced": "24.0.0" }, { "last_affected": "24.14.0" }, { "introduced": "25.0.0" }, { "last_affected": "25.8.1" } ], "source": "CPE_RANGE" }
Affected versions
v0.*
v0.0.1
v0.0.2
v0.0.3
v0.0.4
v0.0.6
v0.1.0
v0.1.1
v0.1.10
v0.1.100
v0.1.101
v0.1.102
v0.1.103
v0.1.104
v0.1.11
v0.1.12
v0.1.13
v0.1.14
v0.1.15
v0.1.16
v0.1.17
v0.1.18
v0.1.19
v0.1.2
v0.1.20
v0.1.21
v0.1.22
v0.1.23
v0.1.24
v0.1.25
v0.1.26
v0.1.27
v0.1.28
v0.1.29
v0.1.3
v0.1.30
v0.1.31
v0.1.32
v0.1.33
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v0.1.8
v0.1.9
v0.1.92
v0.1.93
v0.1.94
v0.1.95
v0.1.96
v0.1.97
v0.1.98
v0.1.99
v0.2.0
v0.3.0
v0.3.1
v0.3.2
v0.3.4
v0.3.5
v0.3.6
v0.3.7
v0.3.8
v0.4.0
v0.5.0
v0.5.1
v0.5.10
v0.5.2
v0.5.3
v0.5.4
v0.5.5
v0.5.5-rc1
v0.5.6
v0.5.7
v0.5.8
v0.5.9
v0.6.0
v0.6.1
v0.7.0
v0.7.2
v0.7.3
v1.*
v1.0.1
v1.0.1-release
v1.0.2
v1.0.2-release
v1.0.3
v1.0.4
v1.1.0
v1.2.0
v1.3.0
v1.4.1
v1.4.2
v1.4.3
v1.5.0
v1.5.1
v1.6.0
v1.6.1
v1.6.2
v1.6.3
v1.6.4
v1.7.0
v1.7.1
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.1.0
v2.2.0
v2.2.1
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.3.4
v2.4.0
v2.5.0
v20.*
v20.0.0
v20.1.0
v20.10.0
v20.11.0
v20.11.1
v20.12.0
v20.12.1
v20.12.2
v20.13.0
v20.13.1
v20.14.0
v20.15.0
v20.15.1
v20.16.0
v20.17.0
v20.18.0
v20.18.1
v20.18.2
v20.18.3
v20.19.0
v20.19.1
v20.19.2
v20.19.3
v20.19.4
v20.19.5
v20.19.6
v20.2.0
v20.20.0
v20.20.1
v20.3.0
v20.3.1
v20.4.0
v20.5.0
v20.5.1
v20.6.0
v20.6.1
v20.7.0
v20.8.0
v20.8.1
v20.9.0
v22.*
v22.0.0
v22.1.0
v22.10.0
v22.11.0
v22.12.0
v22.13.0
v22.13.1
v22.14.0
v22.15.0
v22.15.1
v22.16.0
v22.17.0
v22.17.1
v22.18.0
v22.19.0
v22.2.0
v22.20.0
v22.21.0
v22.21.1
v22.22.0
v22.22.1
v22.3.0
v22.4.0
v22.4.1
v22.5.0
v22.5.1
v22.6.0
v22.7.0
v22.8.0
v22.9.0
v24.*
v24.0.0
v24.0.1
v24.0.2
v24.1.0
v24.10.0
v24.11.0
v24.11.1
v24.12.0
v24.13.0
v24.13.1
v24.14.0
v24.2.0
v24.3.0
v24.4.0
v24.4.1
v24.5.0
v24.6.0
v24.7.0
v24.8.0
v24.9.0
v25.*
v25.0.0
v25.1.0
v25.2.0
v25.2.1
v25.3.0
v25.4.0
v25.5.0
v25.6.0
v25.6.1
v25.7.0
v25.8.0
v25.8.1
v3.*
v3.0.0