CVE-2026-21717

published 2026-03-30

CVE-2026-21717: A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By…

medium 5.9 CVSS 3.0

AV N AC H PR N UI N S U C N I N A H

A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process.

The most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table.

This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.

Affected

26 ranges · showing 25

Vendor	Product	Version range	Fixed in
debian	nodejs	< nodejs 22.22.2+dfsg+~cs22.19.15-1 (forky)	nodejs 22.22.2+dfsg+~cs22.19.15-1 (forky)
nodejs	node	>= 10.0 < 10.*	10.*
nodejs	node	>= 11.0 < 11.*	11.*
nodejs	node	>= 12.0 < 12.*	12.*
nodejs	node	>= 13.0 < 13.*	13.*
nodejs	node	>= 14.0 < 14.*	14.*
nodejs	node	>= 15.0 < 15.*	15.*
nodejs	node	>= 16.0 < 16.*	16.*
nodejs	node	>= 17.0 < 17.*	17.*
nodejs	node	>= 18.0 < 18.*	18.*
nodejs	node	>= 19.0 < 19.*	19.*
nodejs	node	20.20.1 – 20.20.1	—
nodejs	node	22.22.1 – 22.22.1	—
nodejs	node	24.14.0 – 24.14.0	—
nodejs	node	25.8.1 – 25.8.1	—
nodejs	node	>= 4.0 < 4.*	4.*
nodejs	node	>= 5.0 < 5.*	5.*
nodejs	node	>= 6.0 < 6.*	6.*
nodejs	node	>= 7.0 < 7.*	7.*
nodejs	node	>= 8.0 < 8.*	8.*
nodejs	node	>= 9.0 < 9.*	9.*
nodejs	nodejs	>= 0 < 22.22.2-r0	22.22.2-r0
nodejs	nodejs	>= 0 < 22.22.2-r0	22.22.2-r0
nodejs	nodejs	>= 0 < 24.14.1-r0	24.14.1-r0
nodejs	nodejs	>= 0 < 20.19.2+dfsg-1+deb13u2	20.19.2+dfsg-1+deb13u2

CVSS provenance

nvd v3.0 5.9 MEDIUM CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

osv 5.9 MEDIUM

CWE-328