CVE-2026-21710: 
npm vulnerability analysis and mitigation

CVE-2026-21710 is a Denial of Service vulnerability in Node.js HTTP request handling, classified as High severity. When an HTTP request is received with a header named __proto__ and the application accesses req.headersDistinct, an uncaught TypeError is thrown that crashes the Node.js process. The flaw affects all Node.js HTTP servers on versions 20.x, 22.x, 24.x, and 25.x. It was disclosed on March 30, 2026, with patched releases made available on or shortly after March 24, 2026. The CVSS v3.0 base score is 7.5 (High) (Node.js Advisory, GitHub Advisory).

The root cause is a type confusion issue (CWE-843) combined with improper resource handling (CWE-770) in Node.js's HTTP header parsing logic. When a header named __proto__ is received, the internal destination object dest["__proto__"] resolves to Object.prototype rather than undefined due to JavaScript prototype chain behavior. This causes .push() to be called on a non-array object, triggering a synchronous TypeError inside a property getter for req.headersDistinct. Because the exception is thrown synchronously within a getter, it cannot be intercepted by error event listeners, making it impossible to handle gracefully without wrapping every req.headersDistinct access in a try/catch block. A public proof-of-concept exploit (poc.js and server.js) is available on GitHub demonstrating the crash (Node.js Advisory, GitHub PoC).

Successful exploitation results in a complete crash of the affected Node.js process, causing a full denial of service for all users of the application. An unauthenticated remote attacker can trigger this crash with a single crafted HTTP request requiring no privileges or user interaction. There is no confidentiality or integrity impact; the vulnerability is purely an availability issue. Any Node.js HTTP server application on affected versions that accesses req.headersDistinct is vulnerable, including downstream products such as IBM API Connect and IBM App Connect Enterprise (Node.js Advisory, GitHub Advisory).

1. Reconnaissance: Identify internet-facing Node.js HTTP servers running versions 20.x, 22.x, 24.x, or 25.x that access req.headersDistinct in their request handling code. Tools like Shodan or Censys can help identify exposed Node.js services.
2. Craft malicious HTTP request: Construct an HTTP request that includes a header with the name __proto__. For example, using curl or a custom script: curl -H '__proto__: malicious' http://target-server/.
3. Trigger the vulnerability: Send the crafted request to any endpoint on the target server where the application code accesses req.headersDistinct. The property getter resolves dest["__proto__"] to Object.prototype, causing .push() to be called on a non-array.
4. Process crash: The synchronous TypeError propagates as an uncaught exception, crashing the entire Node.js process and causing a denial of service for all users of the application (Node.js Advisory, GitHub PoC).

• Network: Inbound HTTP requests containing a header named __proto__ (e.g., __proto__: <any value>) targeting any endpoint of the Node.js application.
• Logs: Sudden process termination entries in application or system logs; Node.js crash logs showing an uncaught TypeError related to .push() being called on a non-array, originating from the req.headersDistinct property getter.
• Process: Unexpected termination of the Node.js process without a graceful shutdown signal; process manager (e.g., PM2, systemd) logs showing repeated automatic restarts of the Node.js service following receipt of specific HTTP requests.

Node.js has released patched versions addressing this vulnerability: v20.20.2, v22.22.2, v24.14.1, and v25.8.2. Upgrading to one of these versions is the recommended remediation. As a temporary workaround, developers should avoid accessing req.headersDistinct directly, or wrap all such accesses in try/catch blocks to prevent the uncaught exception from crashing the process. IBM has also released patches for affected products including IBM API Connect and IBM App Connect Enterprise Certified Container. Microsoft has published guidance for affected Azure Linux Node.js packages (Node.js Advisory, IBM Advisory, Microsoft MSRC).

The Node.js project officially disclosed the vulnerability as part of its March 2026 security release, rating it High severity alongside CVE-2026-21637. Security news outlets including CyberSecurityNews, GBHackers, and The Cyber Express covered the release, highlighting the DoS risk. HeroDevs published a detailed blog post analyzing the March 2026 Node.js security release. The vulnerability was also tracked by the ENISA European Vulnerability Database (EUVD-2026-17170) and reported on the oss-security mailing list (Node.js Advisory, HeroDevs Blog).