CVE-2026-21717: HashDoS in V8
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process.
The most common trigger is any endpoint that calls JSON.parse() on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table.
This vulnerability affects 20.x, 22.x, 24.x, and 25.x.
Other sources
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process.
The most common trigger is any endpoint that calls JSON.parse() on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table.
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.14.1-3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.14.1-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.20.2Fixed in 22.22.2Fixed in 24.14.1Fixed in 25.8.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.20.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.22.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.14.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 25.8.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.0.0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2026-21717?
CVE-2026-21717 has been rated as a moderate severity vulnerability due to its potential to degrade performance.
How do I fix CVE-2026-21717?
To fix CVE-2026-21717, update Node.js to version 21.0.0 or later.
What types of applications are affected by CVE-2026-21717?
CVE-2026-21717 affects applications built on Node.js versions 20.0.0 through 26.0.0.
What are the potential consequences of CVE-2026-21717?
Exploitation of CVE-2026-21717 can lead to significant performance degradation in applications using V8's string hashing.
Is there a workaround for CVE-2026-21717?
Currently, there are no known workarounds for CVE-2026-21717 apart from upgrading to a fixed version.