CVE-2026-21710
TypeError Vulnerability in Node.js HTTP Header Handling Causes Crashes
Publication date: 2026-03-30
Last updated on: 2026-03-31
Assigner: HackerOne
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nodejs | node.js | From 20.x (inc) to 25.x (inc) |
| nodejs | node.js | 20.* |
| nodejs | node.js | 22.* |
| nodejs | node.js | 24.* |
| nodejs | node.js | 25.* |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should avoid accessing req.headersDistinct without proper error handling.
Specifically, wrap every access to req.headersDistinct in a try/catch block to handle the uncaught TypeError caused by requests containing a __proto__ header.
Additionally, consider updating Node.js to a version where this issue is fixed if available.
Can you explain this vulnerability to me?
This vulnerability is a flaw in Node.js HTTP request handling that causes an uncaught TypeError when a request includes a header named '__proto__' and the application accesses 'req.headersDistinct'.
The issue arises because 'dest["__proto__"]' resolves to 'Object.prototype' instead of 'undefined', leading to a call to '.push()' on a non-array object. This throws an exception synchronously inside a property getter.
The exception cannot be intercepted by error event listeners, meaning it cannot be handled unless every access to 'req.headersDistinct' is wrapped in a try/catch block.
This affects all Node.js HTTP servers running versions 20.x, 22.x, 24.x, and v25.x.
How can this vulnerability impact me? :
This vulnerability can cause Node.js HTTP servers to throw uncaught exceptions when processing requests with a '__proto__' header, leading to application crashes or denial of service.
Because the exception is synchronous and cannot be caught by normal error event listeners, it may cause the server to become unstable or unavailable until restarted.