CVE-2026-21710

Summary: CVE-2026-21710 is a denial-of-service-type issue in Node.js HTTP request handling triggered by a header named __proto__ accessed via req.headersDistinct, which can cause an uncaught TypeError and crash the process when dest["proto "] resolves to Object.prototype and .push() is called on ...

CVE-2026-21714

CVE-2026-21714 is a memory leak in Node.js HTTP/2 that occurs when a client sends WINDOW_UPDATE frames on stream 0, preventing proper Http2Session cleanup and potentially exhausting resources. Affected: Node.js 20, 22, 24, and 25. Connected advisories report fixes in downstream distributions: e.g...

CVE-2026-21716

CVE-2026-21716 : An incomplete fix for CVE-2024-36137 leaves FileHandle.chmod() and FileHandle.chown() in the promises API without required permission checks, while their callback-based counterparts were patched. This can allow code running under --permission with a restricted --allow-fs-write to...

CVE-2026-21713

CVE-2026-21713 (Node.js HMAC timing side-channel) involves a non-constant-time comparison in HMAC verification, exposing potential timing information proportional to the number of matching bytes. The issue is present across 20.x, 22.x, 24.x, and 25.x releases. The advisories note that Node.js alr...

CVE-2026-21717

CVE-2026-21717 affects multiple Node.js releases (nodejs20, nodejs22, nodejs24, nodejs25) with the root cause in V8 string hashing causing integer-like strings to hash to their numeric value, enabling hash collisions that can degrade Node.js process performance. Public details show nodejs24 is af...

CVE-2026-21715

The CVE-2026-21715 issue affects Node.js in the 20.x, 22.x, 24.x and 25.x streams with the Permission Model. The root cause is that fs.realpathSync.native() bypasses required read-permission checks, allowing code running with --permission and restricted --allow-fs-read to reveal file existence, r...