CVE-2026-21710: Denial of Service via `__proto__` header name in `req.headersDistinct` (Uncaught `TypeError` crashes Node.js process)
A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request is received with a header named proto and the application accesses req.headersDistinct.
When this occurs, dest["proto"] resolves to Object.prototype rather than undefined, causing .push() to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by error event listeners, meaning it cannot be handled without wrapping every req.headersDistinct access in a try/catch.
This vulnerability affects all Node.js HTTP servers on 20.x, 22.x, 24.x, and v25.x
Other sources
A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request is received with a header named proto and the application accesses req.headersDistinct.
When this occurs, dest["proto"] resolves to Object.prototype rather than undefined, causing .push() to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by error event listeners, meaning it cannot be handled without wrapping every req.headersDistinct access in a try/catch.
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.14.1-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.14.0-15 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.20.2Fixed in 22.22.2Fixed in 24.14.1Fixed in 25.8.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.20.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.22.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.14.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 25.8.2 - Compensating control
Wrap every access to req.headersDistinct in a try/catch block to handle the synchronously thrown TypeError.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2026-21710?
CVE-2026-21710 is classified as a medium severity vulnerability.
How do I fix CVE-2026-21710?
To fix CVE-2026-21710, upgrade Node.js to a version that is not affected, such as 21.0.0 or later.
Which versions of Node.js are affected by CVE-2026-21710?
CVE-2026-21710 affects Node.js versions from 20.0.0 up to 26.0.0, excluding the specified fixed versions.
What is the impact of CVE-2026-21710 on applications?
The impact of CVE-2026-21710 can lead to uncaught exceptions in applications that handle HTTP requests with specific headers.
Is CVE-2026-21710 a remote code execution vulnerability?
No, CVE-2026-21710 does not lead to remote code execution but may cause application crashes due to unhandled errors.