CVE-2026-21710
published 2026-03-30CVE-2026-21710: A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses…
PriorityP357high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
26.36%
97.8th percentile
A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.
When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`.
* This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | nodejs | < nodejs 22.22.2+dfsg+~cs22.19.15-1 (forky) | nodejs 22.22.2+dfsg+~cs22.19.15-1 (forky) |
| nodejs | node | >= 10.0 < 10.* | 10.* |
| nodejs | node | >= 11.0 < 11.* | 11.* |
| nodejs | node | >= 12.0 < 12.* | 12.* |
| nodejs | node | >= 13.0 < 13.* | 13.* |
| nodejs | node | >= 14.0 < 14.* | 14.* |
| nodejs | node | >= 15.0 < 15.* | 15.* |
| nodejs | node | >= 16.0 < 16.* | 16.* |
| nodejs | node | >= 17.0 < 17.* | 17.* |
| nodejs | node | >= 18.0 < 18.* | 18.* |
| nodejs | node | >= 19.0 < 19.* | 19.* |
| nodejs | node | 20.20.1 – 20.20.1 | — |
| nodejs | node | 22.22.1 – 22.22.1 | — |
| nodejs | node | 24.14.0 – 24.14.0 | — |
| nodejs | node | 25.8.1 – 25.8.1 | — |
| nodejs | node | >= 4.0 < 4.* | 4.* |
| nodejs | node | >= 5.0 < 5.* | 5.* |
| nodejs | node | >= 6.0 < 6.* | 6.* |
| nodejs | node | >= 7.0 < 7.* | 7.* |
| nodejs | node | >= 8.0 < 8.* | 8.* |
| nodejs | node | >= 9.0 < 9.* | 9.* |
| nodejs | nodejs | >= 0 < 22.22.2-r0 | 22.22.2-r0 |
| nodejs | nodejs | >= 0 < 22.22.2-r0 | 22.22.2-r0 |
| nodejs | nodejs | >= 0 < 24.14.1-r0 | 24.14.1-r0 |
| nodejs | nodejs | >= 0 < 20.19.2+dfsg-1+deb13u2 | 20.19.2+dfsg-1+deb13u2 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header
vendor_redhat·2026-03-30·CVSS 7.5
CVE-2026-21710 [HIGH] CWE-843 Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header
Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header
A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.
When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`.
* This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**
A flaw was found in Node.js. A remote attacker can exploit this vulnerability by sending a spe
Debian
CVE-2026-21710: nodejs - A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a re...
vendor_debian·2026·CVSS 7.5
CVE-2026-21710 [HIGH] CVE-2026-21710: nodejs - A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a re...
A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 22.22.2+dfsg+~cs22.19.15-1)
sid: resolved (fixed in 22.22.2+dfsg+~cs22.19.15-1)
trixie: resolved (fixe
VulDB
Node.js up to 20.20.1/22.22.1/24.14.0/25.8.1 req.headersDistinct denial of service (Nessus ID 304242)
vuldb·2026-07-02·CVSS 7.5
CVE-2026-21710 [HIGH] Node.js up to 20.20.1/22.22.1/24.14.0/25.8.1 req.headersDistinct denial of service (Nessus ID 304242)
A vulnerability described as problematic has been identified in Node.js up to 20.20.1/22.22.1/24.14.0/25.8.1. This affects an unknown function. Executing a manipulation of the argument req.headersDistinct can lead to denial of service.
This vulnerability is tracked as CVE-2026-21710. The attack can be launched remotely. No exploit exists.
Upgrading the affected component is recommended.
OSV
CVE-2026-21710: A flaw in Node
osv·2026-03-30·CVSS 7.5
CVE-2026-21710 [HIGH] CVE-2026-21710: A flaw in Node
A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.
When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`.
* This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**
OSV
CVE-2026-21710: A flaw in Node
osv·2026-03-30·CVSS 7.5
CVE-2026-21710 [HIGH] CVE-2026-21710: A flaw in Node
A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**
GHSA
GHSA-xv6w-gxj8-v943: A flaw in Node
ghsa_unreviewed·2026-03-30
CVE-2026-21710 [HIGH] CWE-770 GHSA-xv6w-gxj8-v943: A flaw in Node
A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.
When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`.
* This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**
No detection rules found.
No public exploits indexed.
Hackernews
⚡ Weekly Recap: Telecom Sleeper Cells, LLM Jailbreaks, Apple Forces U.K. Age Checks and More
blogs_hackernews·2026-03-30·CVSS 9.3
[CRITICAL] ⚡ Weekly Recap: Telecom Sleeper Cells, LLM Jailbreaks, Apple Forces U.K. Age Checks and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Telecom Sleeper Cells, LLM Jailbreaks, Apple Forces U.K. Age Checks and More
Some weeks are loud. This one was quieter but not in a good way. Long-running operations are finally hitting courtrooms, old attack methods are showing up in new places, and research that stopped being theoretical right around the time defenders stopped paying attention.
There's a bit of everything this week. Persistence plays, legal wins, influence ops, and at least one thing that looks boring until you see what it connects to.
All of it below. Let's go.
## ⚡ Threat of the Week
Citrix Flaw Comes Under Active Exploitation — A cr
Wiz
CVE-2026-21710 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2026-21710 [HIGH] CVE-2026-21710 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21710 :
Node.js vulnerability analysis and mitigation
TypeError
__proto__
req.headersDistinct
dest["__proto__"]
Object.prototype
undefined
.push()
error
req.headersDistinct
try/catch
This vulnerability affects all Node.js HTTP servers on 20.x, 22.x, 24.x, and v25.x
Source : NVD
## 7.5
Score
Published March 30, 2026
Severity HIGH
CNA Score 7.5
Affected Technologies
Node.js
Linux Red Hat
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 5.8
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nodejs:20::nodejs-nodemon
nodejs:20::v8-13.6-devel
Sources
NVD
Alpine 3.21 Severity HIGH Has Fix Added at: Apr 06, 2026
Alpine 3.22, 3.23, edge Severity
Bugzilla
CVE-2026-21710 nodejs22: Node.js: Denial of Service due to crafted HTTP `__proto__` header [fedora-all]
bugzilla·2026-03-31·CVSS 7.5
CVE-2026-21710 [HIGH] CVE-2026-21710 nodejs22: Node.js: Denial of Service due to crafted HTTP `__proto__` header [fedora-all]
CVE-2026-21710 nodejs22: Node.js: Denial of Service due to crafted HTTP `__proto__` header [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-3b76d8047d (nodejs22-22.22.2-3.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-3b76d8047d
Bugzilla
CVE-2026-21710 nodejs20: Node.js: Denial of Service due to crafted HTTP `__proto__` header [fedora-all]
bugzilla·2026-03-31·CVSS 7.5
CVE-2026-21710 [HIGH] CVE-2026-21710 nodejs20: Node.js: Denial of Service due to crafted HTTP `__proto__` header [fedora-all]
CVE-2026-21710 nodejs20: Node.js: Denial of Service due to crafted HTTP `__proto__` header [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-9dc3a61ad8 (nodejs20-20.20.2-3.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-9dc3a61ad8
---
FEDORA-2026-c99f9dc3b1 (nodejs20-20.20.2-3.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-c99f9dc3b1
---
FEDORA-2026-c99f9dc3b1 has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the fo
Bugzilla
CVE-2026-21710 Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header
bugzilla·2026-03-30·CVSS 7.5
CVE-2026-21710 [HIGH] CVE-2026-21710 Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header
CVE-2026-21710 Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header
A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.
When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`.
* This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**
Discussion:
This issue has been addressed in the following products:
Red Ha
https://nodejs.org/en/blog/vulnerability/march-2026-security-releaseshttps://access.redhat.com/errata/RHSA-2026:7080https://access.redhat.com/errata/RHSA-2026:7123https://access.redhat.com/errata/RHSA-2026:7302https://access.redhat.com/errata/RHSA-2026:7310https://access.redhat.com/errata/RHSA-2026:7350https://access.redhat.com/errata/RHSA-2026:7670https://access.redhat.com/errata/RHSA-2026:7675https://access.redhat.com/errata/RHSA-2026:7896https://access.redhat.com/errata/RHSA-2026:7983https://access.redhat.com/errata/RHSA-2026:8339https://access.redhat.com/errata/RHSA-2026:9711https://access.redhat.com/errata/RHSA-2026:9874https://access.redhat.com/security/cve/CVE-2026-21710https://bugzilla.redhat.com/show_bug.cgi?id=2453151https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21710.json
2026-03-30
Published