CVE-2026-21712: Assertion error in node_url.cc via malformed URL format leads to Node.js crash
A flaw in Node.js URL processing causes an assertion failure in native code when url.format() is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.
Other sources
A flaw in Node.js URL processing causes an assertion failure in native code when url.format() is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.14.1Fixed in 25.8.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.14.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 25.8.2
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2026-21712?
CVE-2026-21712 is a critical vulnerability that can cause Node.js processes to crash due to improper handling of malformed internationalized domain names.
How do I fix CVE-2026-21712?
To fix CVE-2026-21712, upgrade to the latest version of Node.js where the vulnerability has been patched.
What are the potential impacts of CVE-2026-21712?
The potential impact of CVE-2026-21712 includes application crashes and denial of service in Node.js applications.
Which versions of Node.js are affected by CVE-2026-21712?
CVE-2026-21712 affects all versions of Node.js prior to the release of the patch addressing this vulnerability.
How can I determine if my Node.js application is vulnerable to CVE-2026-21712?
You can determine if your Node.js application is vulnerable by checking the version you are running and comparing it to the patched versions available.