CVE-2026-21717: 
npm vulnerability analysis and mitigation

CVE-2026-21717 is a HashDoS (Hash Denial of Service) vulnerability in Node.js caused by a flaw in V8's string hashing mechanism. Integer-like strings are hashed to their numeric value, making hash collisions trivially predictable; an attacker can craft requests that cause many collisions in V8's internal string table, significantly degrading Node.js process performance. The vulnerability affects Node.js versions 20.x, 22.x, 24.x, and 25.x. It was disclosed on March 30, 2026, and carries a CVSS v3.0 base score of 5.9 (Medium) (Node.js Advisory, GitHub Advisory).

The root cause is classified as CWE-328 (Use of Weak Hash): V8's string internalization table hashes integer-like strings (e.g., "0", "1", "12345") directly to their numeric value rather than using a collision-resistant hash function, making the hash distribution predictable and trivially exploitable (GitHub Advisory). An attacker exploits this by sending HTTP requests containing JSON payloads with many integer-like string keys that all map to the same hash bucket, triggering quadratic probing behavior in V8's internal string table and causing severe CPU degradation. The most common attack surface is any endpoint that calls JSON.parse() on attacker-controlled input, since JSON parsing automatically internalizes short strings into the affected hash table. A public PoC (poc.js) demonstrates that crafting approximately 130,000 colliding strings results in over 44 seconds of CPU time for a single JSON.parse() call (PoC GitHub). No authentication or special privileges are required, though attack complexity is rated High due to the need to craft a specific collision chain (Node.js Advisory).

Successful exploitation causes severe performance degradation of the Node.js process, potentially rendering the service completely unavailable (Denial of Service). There is no confidentiality or integrity impact — the vulnerability is purely an availability issue affecting any Node.js application that processes attacker-controlled JSON or string input. In high-traffic environments, a single malicious request with a crafted payload could monopolize CPU resources and cause cascading failures across dependent services (Node.js Advisory, GitHub Advisory).

1. Reconnaissance: Identify Node.js services (versions 20.x, 22.x, 24.x, or 25.x) that expose HTTP endpoints accepting JSON input, using tools like Shodan, Censys, or manual probing.
2. Identify JSON parsing endpoints: Locate API endpoints that call JSON.parse() on attacker-controlled request bodies (e.g., REST APIs accepting Content-Type: application/json).
3. Craft collision payload: Generate a JSON object with approximately 130,000 integer-like string keys (e.g., {"0": 1, "1": 1, ..., "130000": 1}) that all hash to the same bucket in V8's string internalization table, creating a quadratic probing chain. The public PoC (poc.js) automates this step.
4. Send malicious request: Submit the crafted JSON payload via an HTTP POST request to the target endpoint. No authentication is required.
5. Observe impact: The target Node.js process experiences extreme CPU saturation (44+ seconds per parse call in PoC testing), causing the service to become unresponsive or crash under load (PoC GitHub, Node.js Advisory).

• Network: Unusually large JSON request bodies (potentially hundreds of KB to MB) sent to API endpoints; repeated POST requests with similar payload structures from the same source IP.
• Process: Node.js process CPU usage spiking to near 100% for extended periods (tens of seconds) following receipt of specific requests; event loop lag metrics showing extreme delays.
• Logs: Application logs showing requests that take abnormally long to process (>10 seconds) for JSON.parse() operations; Node.js performance monitoring tools (e.g., --prof, clinic.js) showing V8 string internalization as a CPU hotspot.
• Application Metrics: Sudden drop in request throughput or increase in response latency correlated with specific inbound requests; health check failures or timeout errors from load balancers following receipt of crafted payloads.

Upgrade Node.js to the patched releases: v20.20.2, v22.22.2, v24.14.1, or v25.8.2, which contain the fix contributed by joyeecheung (Node.js Advisory). Red Hat has issued patches via RHSA-2026:7350 (RHEL 9), RHSA-2026:7670 (RHEL 8), and RHSA-2026:7675 (RHEL 10) (Red Hat Bugzilla). IBM has addressed the issue in IBM API Connect (IBM Advisory). As interim mitigations, implement strict request body size limits, rate limiting on JSON-parsing endpoints, and input validation to reject payloads with excessive numbers of keys before passing them to JSON.parse().

The Node.js project disclosed the vulnerability as part of a broader March 2026 security release addressing nine CVEs, with CVE-2026-21717 rated Medium severity (Node.js Advisory). HeroDevs published a detailed technical blog post explaining the V8 HashDoS mechanism and remediation steps (HeroDevs Blog). Security news outlets including CyberSecurityNews, GBHackers, and The Cyber Express covered the Node.js security release, highlighting the DoS risks. The vulnerability was also tracked by the OpenSUSE, Debian, Mageia, and Amazon Linux security teams, all issuing downstream advisories.