UpHeron
All vulnerabilities

Servers and applications

CVE-2026-21712

Assertion error in `node_url.cc` via malformed URL format leads to Node.js crash

Severity
Medium 6.5
Published
24 Mar 2026
Last changed
19 Aug 2026
Added to UpHeron
21 Oct 2026
Fixed in
24.14.1, 25.8.2
Sources
NVD, nodejs

Description

A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • From 24.0.0 up to 24.14.0
  • From 24.0.0 before 24.14.1
  • From 25.0.0 up to 25.8.1
  • From 25.0.0 before 25.8.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-21712
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-21712
  • Node.js security release https://nodejs.org/en/blog/vulnerability/march-2026-security-releases