CVE-2026-21710 — nodejs / node

Description (CNA)

A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**

Affected (CNA)

Vendor / product	Versions
nodejs / node	affected 20.20.1 through 20.20.1; affected 22.22.1 through 22.22.1; affected 24.14.0 through 24.14.0; affected 25.8.1 through 25.8.1; affected 4.0 before 4.; affected 5.0 before 5.; affected 6.0 before 6.; affected 7.0 before 7.; affected 8.0 before 8.; affected 9.0 before 9.; affected 10.0 before 10.; affected 11.0 before 11.; affected 12.0 before 12.; affected 13.0 before 13.; affected 14.0 before 14.; affected 15.0 before 15.; affected 16.0 before 16.; affected 17.0 before 17.; affected 18.0 before 18.; affected 19.0 before 19.

Vendor / product

Versions

nodejs / node

affected 20.20.1 through 20.20.1; affected 22.22.1 through 22.22.1; affected 24.14.0 through 24.14.0; affected 25.8.1 through 25.8.1; affected 4.0 before 4.*; affected 5.0 before 5.*; affected 6.0 before 6.*; affected 7.0 before 7.*; affected 8.0 before 8.*; affected 9.0 before 9.*; affected 10.0 before 10.*; affected 11.0 before 11.*; affected 12.0 before 12.*; affected 13.0 before 13.*; affected 14.0 before 14.*; affected 15.0 before 15.*; affected 16.0 before 16.*; affected 17.0 before 17.*; affected 18.0 before 18.*; affected 19.0 before 19.*

CWE

No CWE identifiers supplied.

References

https://nodejs.org/en/blog/vulnerability/march-2026-security-releases

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in Node.js. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request that includes a header named `__proto__`. When a Node.js application processes this request and attempts to access distinct headers, it encounters an unhandled error, leading to an application crash. This can result in a Denial of Service (DoS), making the affected service unavailable to users.