CVE-2026-21717
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process. The most common trigger is any endpoint that calls JSON.parse() on attacker-controlled input. This vulnerability affects 20.x, 22.x, 24.x, and 25.x.
Risk Assessment
An attacker can perform a denial-of-service (DoS) attack by degrading Node.js process performance, potentially leading to application unavailability.
Recommendation
Update Node.js to the latest patched version within the affected branches (20.x, 22.x, 24.x, 25.x).
Other vulnerabilities in Node.js
See all- CVE-2026-21637High
A vulnerability in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths, leading to immediate process termination or silent file descriptor leaks that eventually cause denial of service.
- CVE-2025-59466High
A bug has been identified in Node.js error handling where 'Maximum call stack size exceeded' errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications relying on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
- CVE-2025-59464High
A memory leak in Node.js's OpenSSL integration occurs when converting X.509 certificate fields to UTF-8 without freeing the allocated buffer. Applications calling socket.getPeerCertificate(true) leak memory per certificate field, allowing remote clients to trigger steady memory growth through repeated TLS connections.
- CVE-2015-7384High
Node.js versions 4.0.0, 4.1.0, and 4.1.1 allow remote attackers to cause a denial of service.
- CVE-2017-14849High
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to '..' handling was incompatible with the pathname validation used by unspecified community modules.
- CVE-2017-11499High
Node.js versions from 4.0 to 4.8.3, all 5.x versions, and versions 6.0 to 6.11.0, 7.0 to 7.10.0, and 8.0 to 8.1.3 were susceptible to hash flooding DoS attacks. This was due to the HashTable seed being constant across a given released version of Node.js.
- CVE-2016-2216High
The HTTP header parsing code in Node.js in versions 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header.
- CVE-2016-2086High
Node.js versions 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 are vulnerable to HTTP request smuggling attacks via a crafted Content-Length HTTP header.
- CVE-2015-8027High
Node.js versions 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 do not ensure the availability of a parser for each HTTP socket, allowing remote attackers to cause a denial of service via a pipelined HTTP request.
- CVE-2026-21710High
A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request with a header named __proto__ is received and the application accesses req.headersDistinct. The exception is thrown synchronously inside a property getter and cannot be intercepted by error event listeners.
Original NVD description (English source)
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process. The most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.