CVE-2026-21710High· 7.5▾ MidnightPoC availableA flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `O…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 5 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
26%
1 GitHub repo
A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request is received with a header named __proto__ and the application accesses req.headersDistinct.
When this occurs, dest["__proto__"] resolves to Object.prototype rather than undefined, causing .push() to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by error event listeners, meaning it cannot be handled without wrapping every req.headersDistinct access in a try/catch.
node.js <= 20.20.1node.js >= 22.0.0, <= 22.22.1node.js >= 24.0.0, <= 24.14.0node.js >= 25.0.0, <= 25.8.1enterprise_linux = 8.0enterprise_linux = 9.0enterprise_linux = 10.0enterprise_linux_eus = 9.4enterprise_linux_eus = 9.6enterprise_linux_eus = 10.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-1526High· 7.5The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression
CVE-2026-2229High· 7.5ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension
CVE-2026-1528High· 7.5ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length
CVE-2026-21717Medium· 5.9A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable
CVE-2026-21711Medium· 5.3A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running unde…
CVE-2026-21712Medium· 6.5A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.