{“lastseen”:””,”description”:”A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.\\r\\n\\r\\nWhen this occurs, `dest[\\”__proto__\\”]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try\/catch`.\\r\\n\\r\\n* This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**”,”published”:”2026-03-30T19:07:28.558Z”,”modified”:”2026-03-31T13:55:23.719Z”,”type”:”cve”,”title”:”CVE-2026-21710″,”source”:”hackerone”,”references”:”https:\/\/nodejs.org\/en\/blog\/vulnerability\/march-2026-security-releases”,”id”:”CVE-2026-21710″,”bulletinFamily”:””,”cwe”:[“CWE-770″],”cvelist”:null,”sourceData”:”nodejs node 20.20.1\\nnodejs node 22.22.1\\nnodejs node 24.14.0\\nnodejs node 25.8.1\\nnodejs node 4.0\\nnodejs node 5.0\\nnodejs node 6.0\\nnodejs node 7.0\\nnodejs node 8.0\\nnodejs node 9.0\\nnodejs node 10.0\\nnodejs node 11.0\\nnodejs node 12.0\\nnodejs node 13.0\\nnodejs node 14.0\\nnodejs node 15.0\\nnodejs node 16.0\\nnodejs node 17.0\\nnodejs node 18.0\\nnodejs node 19.0″,”sourceHref”:””,”cvss”:{“score”:7.5,”severity”:”HIGH”,”vector”:”CVSS:3.0\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:N\/A:H”,”version”:”3.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”node”,”version”:”20.20.1″,”vendor”:”nodejs”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,16,12,15,13,7,11,5],"class_list":["post-44710","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-75","tag-exploit","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n