A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the…

Description

A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**

Scores

EPSS (exploitation in 30 days)

25.4% · top 2.0% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• CWE-770 Allocation of Resources Without Limits or Throttling (opens in a new tab)All about CWE-770 and its CVEs
• CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') (opens in a new tab)All about CWE-843 and its CVEs

Affected products

• nodejs · node

  • affected 20.20.1 – ≤ 20.20.1
  • affected 22.22.1 – ≤ 22.22.1
  • affected 24.14.0 – ≤ 24.14.0
  • affected 25.8.1 – ≤ 25.8.1
  • affected 4.0 – < 4.*
  • affected 5.0 – < 5.*
  • affected 6.0 – < 6.*
  • affected 7.0 – < 7.*
  • affected 8.0 – < 8.*
  • affected 9.0 – < 9.*
  • affected 10.0 – < 10.*
  • affected 11.0 – < 11.*
  • affected 12.0 – < 12.*
  • affected 13.0 – < 13.*
  • affected 14.0 – < 14.*
  • affected 15.0 – < 15.*
  • affected 16.0 – < 16.*
  • affected 17.0 – < 17.*
  • affected 18.0 – < 18.*
  • affected 19.0 – < 19.*

References (16)

• https://nodejs.org/en/blog/vulnerability/march-2026-security-releases (opens in a new tab)
• https://access.redhat.com/security/cve/CVE-2026-21710 (opens in a new tab)vdb-entryx_refsource_REDHAT
• RHBZ#2453151 (opens in a new tab)issue-trackingx_refsource_REDHAT
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21710.json (opens in a new tab)x_sadp-csaf-vex
• https://access.redhat.com/errata/RHSA-2026:7310 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:7080 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:7675 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:8339 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:7123 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:7670 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:9711 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:9874 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:7983 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:7896 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:7302 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:7350 (opens in a new tab)vendor-advisoryx_refsource_REDHAT

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-21710](https://trackcve.app/badge/CVE-2026-21710.svg)](https://trackcve.app/cve/CVE-2026-21710)

Record last updated 15 Jul 2026, 01:19 UTC.