CVE-2026-21717: Medium severity Node.js Node.js vulnerability
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process.
The most common trigger is any endpoint that calls JSON.parse() on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table.
This vulnerability affects 20.x, 22.x, 24.x, and 25.x.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.14.1-3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.14.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21717?
CVE-2026-21717 has been rated as a moderate severity vulnerability due to its potential to degrade performance.
How do I fix CVE-2026-21717?
To fix CVE-2026-21717, update Node.js to version 21.0.0 or later.
What types of applications are affected by CVE-2026-21717?
CVE-2026-21717 affects applications built on Node.js versions 20.0.0 through 26.0.0.
What are the potential consequences of CVE-2026-21717?
Exploitation of CVE-2026-21717 can lead to significant performance degradation in applications using V8's string hashing.
Is there a workaround for CVE-2026-21717?
Currently, there are no known workarounds for CVE-2026-21717 apart from upgrading to a fixed version.