CVE-2026-21710

highPriorität · verfolgen · 19EPSS 0.250 · 98. PerzentilExploit · PoCDEEURUUS
grimoire priorityP1 · Urgent
Exploitable?
Public exploit
1 exploit · PoC
Likely / severe?
25.0% (98th) EPSS
CVSS 7.5 · high
Is it mine?
58 products
Prüfe deine Angriffsfläche
Who says so?
6 sources
cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-26

A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • Behobennodejs-1:22.22.2-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobennodejs-devel-1:22.22.2-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobennodejs-docs-1:22.22.2-1.el10_1.noarch as component of SUSE Liberty Linux 10suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobennodejs-full-i18n-1:22.22.2-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobennodejs-libs-1:22.22.2-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobennodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobennodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22 as component of SUSE Liberty Linux 8suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobennodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22 as component of SUSE Liberty Linux 8suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobennodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22 as component of SUSE Liberty Linux 8suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobennodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22 as component of SUSE Liberty Linux 8suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobennodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22 as component of SUSE Liberty Linux 8suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobennodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22 as component of SUSE Liberty Linux 8suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobennodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22 as component of SUSE Liberty Linux 8suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobennodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22 as component of SUSE Liberty Linux 8suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobennpm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22 as component of SUSE Liberty Linux 8suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenv8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22 as component of SUSE Liberty Linux 8suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobencorepack24-0:24.14.1-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobencorepack24-0:24.14.1-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobencorepack24-0:24.14.1-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobencorepack24-0:24.14.1-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobennodejs24-0:24.14.1-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobennodejs24-0:24.14.1-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobennodejs24-0:24.14.1-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobennodejs24-0:24.14.1-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobennodejs24-devel-0:24.14.1-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobennodejs24-devel-0:24.14.1-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobennodejs24-devel-0:24.14.1-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobennodejs24-devel-0:24.14.1-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobennodejs24-docs-0:24.14.1-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobennodejs24-docs-0:24.14.1-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobennodejs24-docs-0:24.14.1-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobennodejs24-docs-0:24.14.1-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobennpm24-0:24.14.1-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobennpm24-0:24.14.1-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobennpm24-0:24.14.1-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobennpm24-0:24.14.1-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.5
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.07.5highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · support@hackerone.comAusnutzbarkeit 3.9 · Auswirkung 3.6
v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HsecondaryAusnutzbarkeit 3.9 · Auswirkung 3.6
v3.17.1highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Psecondary · CVSS-BT (t0sche)
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · SUSE Product Security
03

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS
04

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-404USCWE-770USCWE-843US
05

Exploits (1)

Öffentlicher Proof-of-Concept- und Exploit-Code.

06

betroffene Produkte (58)

Betroffene Produkte und Versionsbereiche.

20 von 58 angezeigt
07

Advisories (6)

Hersteller- und Ökosystem-Meldungen dazu.

  • RHSA-2026:7080security update for nodejs222026-04-08csaf · suse_csafDE

    security update for nodejs22

  • RHSA-2026:7123security update for nodejs2026-04-08csaf · suse_csafDE

    security update for nodejs

  • WID-SEC-W-2026-0843Node.js: Mehrere SchwachstellenDeutsch2026-03-24csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsmaßnahmen zu umgehen und Informationen offenzulegen.

  • openSUSE-SU-2026:10504-1corepack24-24.14.1-1.1 on GA media2026-04-08csaf · suse_csafDE

    corepack24-24.14.1-1.1 on GA media

  • BIT-node-2026-217102026-04-06vendor · osvUS

    A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**

  • BIT-node-min-2026-217102026-04-06vendor · osvUS

    A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**

08

auch bekannt als (5)

Weitere Namen und Kennungen dieser Entität.

09

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdfstec_bduosvcert_bundsuse_csafNVDCVE.orgMITRE
veröffentlicht 2026-03-30geändert 2026-08-19
10

Referenzen (19)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan