CVE-2026-21710

Analyzed Analyzed - Analysis Complete

TypeError Vulnerability in Node.js HTTP Header Handling Causes Crashes

Publication date: 2026-03-30

Last updated on: 2026-08-19

Assigner: HackerOne

Description

A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-30

Last Modified

2026-08-19

Generated

2026-09-06

AI Q&A

2026-03-30

EPSS Evaluated

2026-09-05

NVD

CVE-2026-21710

EUVD

EUVD-2026-17170

Affected Vendors & Products

Vendor	Product	Version / Range
nodejs	node.js	From 24.0.0 (inc) to 24.14.0 (inc)
nodejs	node.js	From 25.0.0 (inc) to 25.8.1 (inc)
nodejs	node.js	to 20.20.1 (inc)
nodejs	node.js	From 22.0.0 (inc) to 22.22.1 (inc)
redhat	enterprise_linux	8.0
redhat	enterprise_linux	9.0
redhat	enterprise_linux_eus	9.4
redhat	enterprise_linux	10.0
redhat	enterprise_linux_eus	9.6
redhat	enterprise_linux_eus	10.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-843	The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability is a flaw in Node.js HTTP request handling that causes an uncaught TypeError when a request includes a header named '__proto__' and the application accesses 'req.headersDistinct'.

The issue arises because 'dest["__proto__"]' resolves to 'Object.prototype' instead of 'undefined', leading to a call to '.push()' on a non-array object. This throws an exception synchronously inside a property getter.

The exception cannot be intercepted by error event listeners, meaning it cannot be handled unless every access to 'req.headersDistinct' is wrapped in a try/catch block.

This affects all Node.js HTTP servers running versions 20.x, 22.x, 24.x, and v25.x.

Impact Analysis

This vulnerability can cause Node.js HTTP servers to throw uncaught exceptions when processing requests with a '__proto__' header, leading to application crashes or denial of service.

Because the exception is synchronous and cannot be caught by normal error event listeners, it may cause the server to become unstable or unavailable until restarted.

Mitigation Strategies

To mitigate this vulnerability, you should avoid accessing req.headersDistinct without proper error handling.

Specifically, wrap every access to req.headersDistinct in a try/catch block to handle the uncaught TypeError caused by requests containing a __proto__ header.

Additionally, consider updating Node.js to a version where this issue is fixed if available.

Hi! I’m here to help you understand CVE-2026-21710. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70