PT-2026-28316 · Node.Js+1 · Node.Js+1
Yushengchen
·
Publicado
2026-01-01
·
Atualizado
2026-04-21
·
CVE-2026-21710
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Node.js versions 20.x, 22.x, 24.x and v25.x
Description
A flaw in Node.js HTTP request handling results in an uncaught
TypeError when a request includes a header named proto and the application accesses req.headersDistinct. Specifically, dest[" proto "] incorrectly resolves to Object.prototype instead of undefined, leading to a .push() operation on a non-array. This exception is thrown synchronously within a property getter and cannot be intercepted by standard error event listeners, requiring try/catch blocks around every access to req.headersDistinct for handling. The affected API endpoint involves HTTP request headers, with the vulnerable parameter being proto. The vulnerable function is req.headersDistinct.Recommendations
Node.js versions 20.x: At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Node.js versions 22.x: At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Node.js versions 24.x: At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Node.js version v25.x: At the moment, there is no information about a newer version that contains a fix for this vulnerability.
DoS
Improper Resource Release
Allocation of Resources Without Limits
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Node.Js
Rocky Linux