CVE-2026-21717
published 2026-03-30CVE-2026-21717: A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By…
PriorityP432medium5.9CVSS 3.1
AVNACHPRNUINSUCNINAH
EPSS
0.27%
18.8th percentile
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process.
The most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table.
This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.
Affected
30 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | nodejs | < nodejs 22.22.2+dfsg+~cs22.19.15-1 (forky) | nodejs 22.22.2+dfsg+~cs22.19.15-1 (forky) |
| nodejs | node | >= 10.0 < 10.* | 10.* |
| nodejs | node | >= 11.0 < 11.* | 11.* |
| nodejs | node | >= 12.0 < 12.* | 12.* |
| nodejs | node | >= 13.0 < 13.* | 13.* |
| nodejs | node | >= 14.0 < 14.* | 14.* |
| nodejs | node | >= 15.0 < 15.* | 15.* |
| nodejs | node | >= 16.0 < 16.* | 16.* |
| nodejs | node | >= 17.0 < 17.* | 17.* |
| nodejs | node | >= 18.0 < 18.* | 18.* |
| nodejs | node | >= 19.0 < 19.* | 19.* |
| nodejs | node | 20.20.1 – 20.20.1 | — |
| nodejs | node | 22.22.1 – 22.22.1 | — |
| nodejs | node | 24.14.0 – 24.14.0 | — |
| nodejs | node | 25.8.1 – 25.8.1 | — |
| nodejs | node | >= 4.0 < 4.* | 4.* |
| nodejs | node | >= 5.0 < 5.* | 5.* |
| nodejs | node | >= 6.0 < 6.* | 6.* |
| nodejs | node | >= 7.0 < 7.* | 7.* |
| nodejs | node | >= 8.0 < 8.* | 8.* |
| nodejs | node | >= 9.0 < 9.* | 9.* |
| nodejs | node.js | <= 20.20.1 | — |
| nodejs | node.js | 22.0.0 – 22.22.1 | — |
| nodejs | node.js | 24.0.0 – 24.14.0 | — |
| nodejs | node.js | 25.0.0 – 25.8.1 | — |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv3.05.9MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
osv5.9MEDIUM
vendor_debian5.9MEDIUM
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-326m-34v3-gv5p: A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable
ghsa_unreviewed·2026-03-30
CVE-2026-21717 [MEDIUM] GHSA-326m-34v3-gv5p: A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process.
The most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table.
This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.
OSV
CVE-2026-21717: A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable
osv·2026-03-30·CVSS 5.9
CVE-2026-21717 [MEDIUM] CVE-2026-21717: A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process.
The most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table.
This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.
OSV
CVE-2026-21717: A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable
osv·2026-03-30·CVSS 5.9
CVE-2026-21717 [MEDIUM] CVE-2026-21717: A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process. The most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.
Red Hat
nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions
vendor_redhat·2026-03-30·CVSS 5.9
CVE-2026-21717 [MEDIUM] CWE-328 nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions
nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process.
The most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table.
This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.
A flaw was found in V8's string hashing mechanism within Node.js. A remote attacker can exploit this vulnerability by crafting requests con
Debian
CVE-2026-21717: nodejs - A flaw in V8's string hashing mechanism causes integer-like strings to be hashed...
vendor_debian·2026·CVSS 5.9
CVE-2026-21717 [MEDIUM] CVE-2026-21717: nodejs - A flaw in V8's string hashing mechanism causes integer-like strings to be hashed...
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process. The most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 22.22.2+dfsg+~cs22.19.15-1)
sid: resolved (fixed in 22.22.2+dfsg+~cs22.19.15-1)
trixie: resolved (fixed in 20.19.2+dfsg-1+deb13u2)
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-21710 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2026-21710 [HIGH] CVE-2026-21710 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21710 :
Node.js vulnerability analysis and mitigation
TypeError
__proto__
req.headersDistinct
dest["__proto__"]
Object.prototype
undefined
.push()
error
req.headersDistinct
try/catch
This vulnerability affects all Node.js HTTP servers on 20.x, 22.x, 24.x, and v25.x
Source : NVD
## 7.5
Score
Published March 30, 2026
Severity HIGH
CNA Score 7.5
Affected Technologies
Node.js
Linux Red Hat
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 5.8
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nodejs:20::nodejs-nodemon
nodejs:20::v8-13.6-devel
Sources
NVD
Alpine 3.21 Severity HIGH Has Fix Added at: Apr 06, 2026
Alpine 3.22, 3.23, edge Severity
Wiz
CVE-2026-21717 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.9
CVE-2026-21717 [MEDIUM] CVE-2026-21717 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21717 :
Node.js vulnerability analysis and mitigation
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process.
JSON.parse()
This vulnerability affects 20.x, 22.x, 24.x, and 25.x .
Source : NVD
## 5.9
Score
Published March 30, 2026
Severity MEDIUM
CNA Score 5.9
Affected Technologies
Node.js
Linux Red Hat
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 7.4
Exploitation Probability (EPSS) N/A
Affected packages and librari
Wiz
CVE-2025-55130 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 9.1
CVE-2025-55130 [CRITICAL] CVE-2025-55130 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-55130 :
Node.js vulnerability analysis and mitigation
--allow-fs-read
--allow-fs-write
Source : NVD
## 9.1
Score
Published January 20, 2026
Severity CRITICAL
CNA Score 7.1
Affected Technologies
Node.js
Rocky Linux
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 3
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nodejs:20::npm
nodejs20-devel
Sources
AlmaLinux 8 Severity HIGH Has Fix Added at: Feb 15, 2026
AlmaLinux 9 Severity HIGH Has Fix Added at: Feb 19, 2026
Alpine 3.21 Severity CRITICAL Has Fix Added at: Apr 06, 2026
Alpine 3.22 Severity CRITICAL Has Fix Added at: Jan 23, 2026
Alpine 3.23, edge Severity CRITICAL Has Fix Added at: Jan 18, 2
Wiz
CVE-2025-59464 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2025-59464 [HIGH] CVE-2025-59464 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-59464 :
Node.js vulnerability analysis and mitigation
X.509
socket.getPeerCertificate(true)
Source : NVD
## 7.5
Score
Published January 20, 2026
Severity HIGH
CNA Score 6.5
Affected Technologies
Node.js
Linux Fedora
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 16.4
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
nodejs:24::npm
nodejs20-libs-debuginfo
Sources
Chainguard Has Fix Added at: Feb 02, 2026
Debian 11, 12, 13, 14 No Fix Added at: Jan 14, 2026
Echo No Fix Added at: Jan 14, 2026
MinimOS Severity HIGH Has Fix Added at: Jan 23, 2026
Red Hat 8, 9, 10 Severity MEDIUM No Fix Added at: Jan 21, 2026
Linux Severity HIGH Has Fix Added at: Ja
Wiz
CVE-2026-21716 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.9
CVE-2026-21716 [MEDIUM] CVE-2026-21716 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21716 :
Node.js vulnerability analysis and mitigation
FileHandle.chmod()
FileHandle.chown()
fs.fchmod()
fs.fchown()
--permission
--allow-fs-write
FileHandle
--allow-fs-write
Source : NVD
## 3.3
Score
Published March 30, 2026
Severity LOW
CNA Score 3.3
Affected Technologies
Node.js
Linux Red Hat
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.2
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nodejs:20::npm
nodejs:22::nodejs-full-i18n
Sources
NVD
Alpine 3.21 Severity LOW Has Fix Added at: Apr 06, 2026
Alpine 3.22, 3.23, edge Severity LOW Has Fix Added at: Mar 26, 2026
Debian 11, 12 Severity LOW No Fix Added at: Mar 25, 2026
Debian 13, 1
Wiz
CVE-2026-21715 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.9
CVE-2026-21715 [MEDIUM] CVE-2026-21715 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21715 :
Node.js vulnerability analysis and mitigation
fs.realpathSync.native()
--permission
--allow-fs-read
fs.realpathSync.native()
--allow-fs-read
Source : NVD
## 3.3
Score
Published March 30, 2026
Severity LOW
CNA Score 3.3
Affected Technologies
Node.js
Linux Red Hat
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.2
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nodejs:22::v8-13.6-devel
nodejs:24::nodejs-nodemon
Sources
NVD
Alpine 3.21 Severity LOW Has Fix Added at: Apr 06, 2026
Alpine 3.22, 3.23, edge Severity LOW Has Fix Added at: Mar 26, 2026
Debian 11, 12 Severity LOW No Fix Added at: Mar 25, 2026
Debian 13, 14 Severity LOW Has F
Wiz
CVE-2026-21713 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.9
CVE-2026-21713 [MEDIUM] CVE-2026-21713 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21713 :
Node.js vulnerability analysis and mitigation
A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values.
Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision.
This vulnerability affects 20.x, 22.x, 24.x, and 25.x .
Source : NVD
## 5.9
Score
Published March 30, 2026
Severity MEDIUM
CNA Score 5.9
Affected Technologies
Node.js
Linux Red Hat
Has Public Ex
Wiz
CVE-2025-69418 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 4.0
CVE-2025-69418 [MEDIUM] CVE-2025-69418 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-69418 :
Node.js vulnerability analysis and mitigation
Issue summary: When using the low-level OCB API directly with AES-NI or
other hardware-accelerated code paths, inputs whose length is not a multiple
of 16 bytes can leave the final partial block unencrypted and unauthenticated.
Impact summary: The trailing 1-15 bytes of a message may be exposed in
cleartext on encryption and are not covered by the authentication tag,
allowing an attacker to read or tamper with those bytes without detection.
The low-level OCB encrypt and decrypt routines in the hardware-accelerated
stream path process full 16-byte blocks but do not advance the input/output
pointers. The subsequent tail-handling code then operates on the original
base pointers, effectively reprocessing the beginning of the
Wiz
CVE-2026-21714 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.9
CVE-2026-21714 [MEDIUM] CVE-2026-21714 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21714 :
Node.js vulnerability analysis and mitigation
A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.
This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.
Source : NVD
## 5.3
Score
Published March 30, 2026
Severity MEDIUM
CNA Score 5.3
Affected Technologies
Node.js
Linux Red Hat
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 3.4
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nodejs24-devel
nodejs-de
Wiz
CVE-2026-21636 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 10.0
CVE-2026-21636 [CRITICAL] CVE-2026-21636 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21636 :
Node.js vulnerability analysis and mitigation
--permission
--allow-net
The issue affects users of the Node.js permission model on version v25.
--allow-net
Source : NVD
## 10
Score
Published January 20, 2026
Severity CRITICAL
CNA Score 5.8
Affected Technologies
Node.js
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 6.3
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nodejs-20
nodejs-22
Sources
Chainguard Has Fix Added at: Feb 02, 2026
Debian 13 Severity CRITICAL Has Fix Added at: Jan 19, 2026
MinimOS Severity CRITICAL Has Fix Added at: Jan 23, 2026
Linux Severity CRITICAL Has Fix Added at: Jan 22, 2026
Windows Severity CRITICAL Has F
Wiz
CVE-2025-55132 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
CVE-2025-55132 [MEDIUM] CVE-2025-55132 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-55132 :
Node.js vulnerability analysis and mitigation
futimes()
utimes()
futimes()
Source : NVD
## 5.3
Score
Published January 20, 2026
Severity MEDIUM
CNA Score 2.8
Affected Technologies
Node.js
Rocky Linux
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 1.1
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nodejs24-debuginfo
v8-13.6-devel
Sources
AlmaLinux 8 Severity HIGH Has Fix Added at: Feb 15, 2026
AlmaLinux 9 Severity HIGH Has Fix Added at: Feb 19, 2026
Alpine 3.21 Severity MEDIUM Has Fix Added at: Apr 06, 2026
Alpine 3.22 Severity MEDIUM Has Fix Added at: Jan 23, 2026
Alpine 3.23, edge Severity MEDIUM Has Fix Added at: Jan 18, 2026
C
Wiz
CVE-2026-21712 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.7
CVE-2026-21712 [MEDIUM] CVE-2026-21712 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21712 :
Node.js vulnerability analysis and mitigation
url.format()
Source : NVD
## 5.7
Score
Published March 30, 2026
Severity MEDIUM
CNA Score 5.7
Affected Technologies
Node.js
Linux Red Hat
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 2.8
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nodejs-npm
nodejs:20::nodejs-devel
Sources
NVD
Alpine 3.23, edge Severity MEDIUM Has Fix Added at: Mar 26, 2026
Debian 11, 12, 13, 14 No Fix Added at: Mar 25, 2026
Echo No Fix Added at: Mar 25, 2026
MinimOS Severity MEDIUM Has Fix Added at: Apr 02, 2026
Red Hat 8, 9, 10 Severity MEDIUM No Fix Added at: Apr 02, 2026
Linux Severity MEDIUM Has Fix Added at:
Wiz
CVE-2026-21711 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
CVE-2026-21711 [MEDIUM] CVE-2026-21711 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21711 :
Node.js vulnerability analysis and mitigation
A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.
--permission
--allow-net
--allow-net
--allow-net
Source : NVD
## 5.3
Score
Published March 30, 2026
Severity MEDIUM
CNA Score 5.3
Affected Technologies
Node.js
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.1
Exploitation Probability (EPSS) N/A
Affected packages and libraries
nodejs-25
cpe:2.3:a:nodejs:node.js
Sources
NVD
MinimOS Severity MEDIUM Has Fix Added at: Apr 02, 2026
Linux Severity MEDIUM Has Fix
Bugzilla
CVE-2026-21717 nodejs20: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions [fedora-all]
bugzilla·2026-03-31·CVSS 5.9
CVE-2026-21717 [MEDIUM] CVE-2026-21717 nodejs20: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions [fedora-all]
CVE-2026-21717 nodejs20: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-9dc3a61ad8 (nodejs20-20.20.2-3.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-9dc3a61ad8
---
FEDORA-2026-c99f9dc3b1 (nodejs20-20.20.2-3.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-c99f9dc3b1
---
FEDORA-2026-c99f9dc3b1 has been pushed to the Fedora 44 testing repository.
Soon you'll be able to in
Bugzilla
CVE-2026-21717 nodejs22: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions [fedora-all]
bugzilla·2026-03-31·CVSS 5.9
CVE-2026-21717 [MEDIUM] CVE-2026-21717 nodejs22: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions [fedora-all]
CVE-2026-21717 nodejs22: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-3b76d8047d (nodejs22-22.22.2-3.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-3b76d8047d
Bugzilla
CVE-2026-21717 nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions
bugzilla·2026-03-30·CVSS 5.9
CVE-2026-21717 [MEDIUM] CVE-2026-21717 nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions
CVE-2026-21717 nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process.
The most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table.
This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2026:7350 http
2026-03-30
Published