CVE-2026-21710

HIGH

7.5

CVSS Score

Published: March 30, 2026 at 07:07 PM UTC

Updated: August 19, 2026 at 02:45 PM UTC

3 products affected across 2 vendorsEnterprise LinuxEnterprise Linux EusNode.js

Using node by nodejs?

Get instant alerts when new vulnerabilities affect node - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 25%

SSVC

No known exploit

Description

A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Node.js · Node.js

95%

v ≤ 20.20.110.0 ≤ v < 10.*11.0 ≤ v < 11.*12.0 ≤ v < 12.*13.0 ≤ v < 13.*14.0 ≤ v < 14.*15.0 ≤ v < 15.*16.0 ≤ v < 16.*17.0 ≤ v < 17.*18.0 ≤ v < 18.*19.0 ≤ v < 19.*22.0.0 ≤ v ≤ 22.22.124.0.0 ≤ v ≤ 24.14.025.0.0 ≤ v ≤ 25.8.14.0 ≤ v < 4.*5.0 ≤ v < 5.*6.0 ≤ v < 6.*7.0 ≤ v < 7.*8.0 ≤ v < 8.*9.0 ≤ v < 9.*10.0 11.0 12.0 13.0 14.0 15.0 16.0 17.0 18.0 19.0 20.20.1 22.22.1 24.14.0 25.8.1 4.0 5.0 6.0 7.0 8.0 9.0

Affected range stops below 10.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 11.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 12.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 13.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 14.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 15.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 16.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 17.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 18.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 19.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 5.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 9.*, so it looks safe — our inference, not a vendor statement

Enterprise Linux · Red Hatrpm

95%

10.0 8.0 9.0

Vendor states this is fixed in 1:22.22.2-1.el10_1 (unaffected)

Vendor states this is fixed in 1:22.22.2-2.el10_0 (unaffected)

Vendor states this is fixed in 1:24.14.1-2.el10_1 (unaffected)

Vendor states this is fixed in 8100020260331102257.6d880403 (unaffected)

Vendor states this is fixed in 8100020260408131901.6d880403 (unaffected)

Vendor states this is fixed in 8100020260414073138.489197e6 (unaffected)

Vendor states this is fixed in 9040020260421133644.rhel9 (unaffected)

Vendor states this is fixed in 9060020260409121057.rhel9 (unaffected)

Vendor states this is fixed in 9060020260422064119.rhel9 (unaffected)

Vendor states this is fixed in 9070020260401095228.rhel9 (unaffected)

Vendor states this is fixed in 9070020260402152654.rhel9 (unaffected)

Vendor states this is fixed in 9070020260409073121.rhel9 (unaffected)

Enterprise Linux Eus · Red Hatrpm

95%

10.0 9.4 9.6

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://nodejs.org/en/blog/vulnerability/march-2026-security-releases

References (16)

Vendor Advisory

Source: cverecord

https://nodejs.org/en/blog/vulnerability/march-2026-security-releases

Third Party Advisory