PT-2026-28095 · V8+2 · V8+2
Sharp_Edged
·
Published
2026-01-01
·
Updated
2026-05-05
·
CVE-2026-21717
CVSS v3.1
5.9
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
V8 versions 20.x through 25.x
Description
A flaw exists in V8's string hashing mechanism where integer-like strings are hashed to their numeric value, leading to predictable hash collisions. An attacker can exploit this by crafting requests that cause numerous collisions within V8's internal string table, resulting in a significant performance degradation of the Node.js process. The issue is commonly triggered by endpoints that utilize
JSON.parse() with attacker-controlled input, as this function automatically internalizes short strings into the affected hash table. The root cause is an unseeded hash V8 uses for integer-looking strings, which requires quick reversibility to maintain performance optimizations.Recommendations
Update to a version beyond 25.x.
Exploit
Fix
DoS
Improper Resource Release
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Node.Js
Rocky Linux
V8