CVE-2026-21710 Denial of service in node
An attacker can crash Node.js HTTP servers by sending a request with a __proto__ header, causing an unhandled TypeError in header processing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-21710?
CVE-2026-21710 is a high-severity denial of service vulnerability in Nodejs Node.js, published on 30 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**
Which versions are affected by CVE-2026-21710?
2 open source packages ship an affected version, including node and node-min. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
node Bitnami | All versions | 20.20.2, 22.22.2, 24.14.1, 25.8.2 |
node-min Bitnami | All versions | 20.20.2, 22.22.2, 24.14.1, 25.8.2 |
Products include Nodejs Node.js, Redhat Enterprise Linux, Redhat Enterprise Linux Eus.
How do I fix CVE-2026-21710?
Upgrade node to a fixed version for your release line: 20.20.2, 22.22.2, 24.14.1 or 25.8.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-21710 being exploited?
There is no known exploitation of CVE-2026-21710 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Nodejs Node.js
Sources
Also known as ALPINE-CVE-2026-21710, AZL-81239, AZL-81257, BELL-CVE-2026-21710, BIT-node-2026-21710, BIT-node-min-2026-21710 and 12 more.