6 matches found
CVE-2026-21710
CVE-2026-21710 — Node.js req.headersDistinct DoS Summary Field| Value ---|--- CVE ID| CVE-2026-21710 Published| 2026-03-30 CVSS v3.1| 7.5 HIGH AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE| CWE-770 — Allocation of Resources Without Limits or Throttling Affected| Node.js 20.x, 22.x, 24.x, 25.x Fixed in|...
K000162882: Node.js vulnerability CVE-2026-21710
Security Advisory Description A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request is received with a header named proto and the application accesses req.headersDistinct. When this occurs, dest"proto" resolves to Object.prototype rather than undefined, causing .push...
BIT-NODE-2026-21710
A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request is received with a header named proto and the application accesses req.headersDistinct. When this occurs, dest"proto" resolves to Object.prototype rather than undefined, causing .push to be called on a non-array...
AZL-81257 CVE-2026-21710 affecting package nodejs24 for versions less than 24.14.1-1
A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request is received with a header named proto and the application accesses req.headersDistinct. When this occurs, dest"proto" resolves to Object.prototype rather than undefined, causing .push to be called on a non-array...
AZL-81239 CVE-2026-21710 affecting package nodejs for versions less than 20.14.0-15
A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request is received with a header named proto and the application accesses req.headersDistinct. When this occurs, dest"proto" resolves to Object.prototype rather than undefined, causing .push to be called on a non-array...
CVE-2026-21710
A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request is received with a header named proto and the application accesses req.headersDistinct. When this occurs, dest"proto" resolves to Object.prototype rather than undefined, causing .push to be called on a non-array...