Mitigation Strategies

To mitigate this vulnerability, you should avoid accessing req.headersDistinct without proper error handling.

Specifically, wrap every access to req.headersDistinct in a try/catch block to handle the uncaught TypeError caused by requests containing a __proto__ header.

Additionally, consider updating Node.js to a version where this issue is fixed if available.

Useful 0 Not Useful 0

Executive Summary

This vulnerability is a flaw in Node.js HTTP request handling that causes an uncaught TypeError when a request includes a header named '__proto__' and the application accesses 'req.headersDistinct'.

The issue arises because 'dest["__proto__"]' resolves to 'Object.prototype' instead of 'undefined', leading to a call to '.push()' on a non-array object. This throws an exception synchronously inside a property getter.

The exception cannot be intercepted by error event listeners, meaning it cannot be handled unless every access to 'req.headersDistinct' is wrapped in a try/catch block.

This affects all Node.js HTTP servers running versions 20.x, 22.x, 24.x, and v25.x.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause Node.js HTTP servers to throw uncaught exceptions when processing requests with a '__proto__' header, leading to application crashes or denial of service.

Because the exception is synchronous and cannot be caught by normal error event listeners, it may cause the server to become unstable or unavailable until restarted.

Useful 0 Not Useful 0