SECUFOCUSNOW
Home›CVE index›CVE-2026-21710
Priority reviewHigh

CVE-2026-21710

nodejs node, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support

A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on...

CVSS
7.5
EPSS
26.4%
97.8% percentile
CISA KEV
Not listed
Published
2026.03.31
PRIORITY ASSESSMENT

Priority review

FIRST EPSS indicates an elevated probability of exploitation.

Known exploitationNot established by KEV
Exploit probability26.4%
Technical severityCVSS 7.5

Vulnerability overview

A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on...

Affected product and versions

Product
nodejs node, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support
Affected versions
>= 20.20.1 <= 20.20.1, >= 22.22.1 <= 22.22.1, >= 24.14.0 <= 24.14.0, >= 25.8.1 <= 25.8.1, >= 4.0 < 4.*, >= 5.0 < 5.*, >= 6.0 < 6.*, >= 7.0 < 7.*, >= 8.0 < 8.*, >= 9.0 < 9.*, >= 10.0 < 10.*, >= 11.0 < 11.*, >= 12.0 < 12.*, >= 13.0 < 13.*, >= 14.0 < 14.*, >= 15.0 < 15.*, >= 16.0 < 16.*, >= 17.0 < 17.*, >= 18.0 < 18.*, >= 19.0 < 19.*
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that nodejs node, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
CWE-770, CWE-843
CVE-2026-21710 — nodejs node, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support | SECUFOCUS NOW