CVE-2026-21710

highpriority · track · 19EPSS 0.250 · 98 %ileexploit · PoCDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

25.0% (98th) EPSS

CVSS 7.5 · high

Is it mine?

58 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-26

A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixednodejs-1:22.22.2-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednodejs-devel-1:22.22.2-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednodejs-docs-1:22.22.2-1.el10_1.noarch as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednodejs-full-i18n-1:22.22.2-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednodejs-libs-1:22.22.2-1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednodejs-npm-1:10.9.7-1.22.22.2.1.el10_1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednodejs-devel-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednodejs-docs-1:22.22.2-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednodejs-full-i18n-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednodejs-libs-1:22.22.2-1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednodejs-nodemon-0:3.0.1-1.module+el8.10.0+24148+847b6786.noarch::nodejs:22 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednodejs-packaging-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24148+847b6786.noarch::nodejs:22 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednpm-1:10.9.7-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedv8-12.4-devel-3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786.x86_64::nodejs:22 as component of SUSE Liberty Linux 8suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedcorepack24-0:24.14.1-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedcorepack24-0:24.14.1-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedcorepack24-0:24.14.1-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedcorepack24-0:24.14.1-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednodejs24-0:24.14.1-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednodejs24-0:24.14.1-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednodejs24-0:24.14.1-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednodejs24-0:24.14.1-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednodejs24-devel-0:24.14.1-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednodejs24-devel-0:24.14.1-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednodejs24-devel-0:24.14.1-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednodejs24-devel-0:24.14.1-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednodejs24-docs-0:24.14.1-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednodejs24-docs-0:24.14.1-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednodejs24-docs-0:24.14.1-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednodejs24-docs-0:24.14.1-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednpm24-0:24.14.1-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednpm24-0:24.14.1-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednpm24-0:24.14.1-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixednpm24-0:24.14.1-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.07.5highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · support@hackerone.comexploitability 3.9 · impact 3.6

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondaryexploitability 3.9 · impact 3.6

v3.17.1highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Psecondary · CVSS-BT (t0sche)

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · SUSE Product Security

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-404USCWE-770USCWE-843US

exploits (1)

Public proof-of-concept and weaponised exploit code.

open-flaw/CVE-2026-21710open-flaw/CVE-2026-21710PoC · poc_in_github

affected products (58)

Products and version ranges known to be affected.

Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
HCL BigFix WebUIall versionscert_bundDEcpe:/a:hcltech:bigfix:webui
IBM App Connect Enterpriseall versionscert_bundDEcpe:/a:ibm:app_connect_enterprise:-
IBM Business Automation Workflowall versionscert_bundDEcpe:/a:ibm:business_automation_workflow:-
Oracle Linuxall versionscert_bundDEcpe:/o:oracle:linux:-
RESF Rocky Linuxall versionscert_bundDEcpe:/o:resf:rocky_linux:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
SUSE openSUSEall versionscert_bundDEcpe:/o:suse:opensuse:-
Open Source Node.js< 20.20.2cert_bundDE
Open Source Node.js< 22.22.2cert_bundDE
Open Source Node.js< 24.14.1cert_bundDE
Open Source Node.js< 25.8.2cert_bundDE
nodejs Node≤ 22.22.1 ≤22.22.1enisa_euvdEU
nodejs Node≤ 25.8.1 ≤25.8.1enisa_euvdEU
nodejs Node≤ 20.20.1 ≤20.20.1enisa_euvdEU
nodejs Node≤ 24.14.0 ≤24.14.0enisa_euvdEU
nodejs Node10.0 → 10.*enisa_euvdEU
nodejs Node11.0 → 11.*enisa_euvdEU
nodejs Node12.0 → 12.*enisa_euvdEU

showing 20 of 58

advisories (6)

Vendor and ecosystem advisories describing this.

RHSA-2026:7080security update for nodejs222026-04-08csaf · suse_csafDE
security update for nodejs22
RHSA-2026:7123security update for nodejs2026-04-08csaf · suse_csafDE
security update for nodejs
WID-SEC-W-2026-0843Node.js: Mehrere SchwachstellenDeutsch2026-03-24csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsmaßnahmen zu umgehen und Informationen offenzulegen.
openSUSE-SU-2026:10504-1corepack24-24.14.1-1.1 on GA media2026-04-08csaf · suse_csafDE
corepack24-24.14.1-1.1 on GA media
BIT-node-2026-217102026-04-06vendor · osvUS
A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**
BIT-node-min-2026-217102026-04-06vendor · osvUS
A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund suse_csaf NVD CVE.org MITRE

published 2026-03-30modified 2026-08-19

references (19)

External citations — patches, advisories, analysis.

https://nodejs.org/en/blog/vulnerability/march-2026-security-releases cnnvd
https://nodejs.org/en/downloadPatchcnnvd
https://nodejs.org/en/blog/vulnerability/march-2026-security-releases enisa_euvd
https://access.redhat.com/errata/RHSA-2026:7080Third Party Advisorynvd
https://access.redhat.com/errata/RHSA-2026:7123Third Party Advisorynvd
https://access.redhat.com/errata/RHSA-2026:7302Third Party Advisorynvd
https://access.redhat.com/errata/RHSA-2026:7310Third Party Advisorynvd
https://access.redhat.com/errata/RHSA-2026:7350Third Party Advisorynvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan