UpHeron
All vulnerabilities

Servers and applications

CVE-2026-21710

Denial of Service via `__proto__` header name in `req.headersDistinct` (Uncaught `TypeError` crashes Node.js process)

Severity
High 7.5
Published
24 Mar 2026
Last changed
19 Aug 2026
Added to UpHeron
21 Oct 2026
Fixed in
20.20.2, 22.22.2, 24.14.1, 25.8.2
Sources
NVD, nodejs

Description

A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot…

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • From 25.0.0 before 25.8.2
  • From 25.0.0 up to 25.8.1
  • From 24.0.0 before 24.14.1
  • From 24.0.0 up to 24.14.0
All 8 release lines
  • Every version up to 20.20.1
  • From 20.0.0 before 20.20.2
  • From 22.0.0 up to 22.22.1
  • From 22.0.0 before 22.22.2
  • From 24.0.0 up to 24.14.0
  • From 24.0.0 before 24.14.1
  • From 25.0.0 up to 25.8.1
  • From 25.0.0 before 25.8.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-21710
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-21710
  • Node.js security release https://nodejs.org/en/blog/vulnerability/march-2026-security-releases