CVE-2026-21712
Assertion Failure in Node.js URL.format() Causes Process Crash
Publication date: 2026-03-30
Last updated on: 2026-03-30
Assigner: HackerOne
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nodejs | node.js | 24.14.1 |
| nodejs | node.js | 25.8.2 |
| nodejs | node.js | From 20.0.0 (inc) to 26.0.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-21712 is a medium severity vulnerability in Node.js that occurs when the url.format() function is called with a malformed internationalized domain name (IDN) containing invalid characters.
This malformed input causes an assertion failure in the native code (specifically in the file node_url.cc), which leads to the Node.js process crashing.
How can this vulnerability impact me? :
The vulnerability can cause the Node.js process to crash unexpectedly when processing certain malformed URLs.
This crash can lead to denial of service conditions in applications relying on Node.js, potentially disrupting service availability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability causes the Node.js process to crash when the `url.format()` function is called with a malformed internationalized domain name (IDN) containing invalid characters.
To detect this vulnerability on your system, you can monitor for unexpected Node.js process crashes or assertion failures related to URL processing.
There are no specific commands provided in the available resources to detect this vulnerability directly.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade Node.js to a fixed version that addresses this vulnerability.
- Upgrade to Node.js version 24.14.1 or later if you are using the 24.x release line.
- Upgrade to Node.js version 25.8.2 or later if you are using the 25.x release line.
These versions include the fix for CVE-2026-21712 and prevent the assertion failure caused by malformed IDNs.