CVE-2026-21710

published 2026-03-30

CVE-2026-21710: A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses…

high 7.5 CVSS 3.0

AV N AC L PR N UI N S U C N I N A H

A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.

When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`.

* This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**

Affected

26 ranges · showing 25

Vendor	Product	Version range	Fixed in
debian	nodejs	< nodejs 22.22.2+dfsg+~cs22.19.15-1 (forky)	nodejs 22.22.2+dfsg+~cs22.19.15-1 (forky)
nodejs	node	>= 10.0 < 10.*	10.*
nodejs	node	>= 11.0 < 11.*	11.*
nodejs	node	>= 12.0 < 12.*	12.*
nodejs	node	>= 13.0 < 13.*	13.*
nodejs	node	>= 14.0 < 14.*	14.*
nodejs	node	>= 15.0 < 15.*	15.*
nodejs	node	>= 16.0 < 16.*	16.*
nodejs	node	>= 17.0 < 17.*	17.*
nodejs	node	>= 18.0 < 18.*	18.*
nodejs	node	>= 19.0 < 19.*	19.*
nodejs	node	20.20.1 – 20.20.1	—
nodejs	node	22.22.1 – 22.22.1	—
nodejs	node	24.14.0 – 24.14.0	—
nodejs	node	25.8.1 – 25.8.1	—
nodejs	node	>= 4.0 < 4.*	4.*
nodejs	node	>= 5.0 < 5.*	5.*
nodejs	node	>= 6.0 < 6.*	6.*
nodejs	node	>= 7.0 < 7.*	7.*
nodejs	node	>= 8.0 < 8.*	8.*
nodejs	node	>= 9.0 < 9.*	9.*
nodejs	nodejs	>= 0 < 22.22.2-r0	22.22.2-r0
nodejs	nodejs	>= 0 < 22.22.2-r0	22.22.2-r0
nodejs	nodejs	>= 0 < 24.14.1-r0	24.14.1-r0
nodejs	nodejs	>= 0 < 20.19.2+dfsg-1+deb13u2	20.19.2+dfsg-1+deb13u2

CVSS provenance

nvd v3.0 7.5 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

osv 7.5 HIGH

CWE-770 CWE-843