PT-2026-28316 · Node.Js+1 · Node.Js+1
Yushengchen
·
Published
2026-01-01
·
Updated
2026-04-21
·
CVE-2026-21710
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Node.js versions 20.x, 22.x, 24.x and v25.x
Description
A flaw in Node.js HTTP request handling results in an uncaught
TypeError when a request includes a header named proto and the application accesses req.headersDistinct. Specifically, dest[" proto "] incorrectly resolves to Object.prototype instead of undefined, leading to a .push() operation on a non-array. This exception is thrown synchronously within a property getter and cannot be intercepted by standard error event listeners, requiring try/catch blocks around every access to req.headersDistinct for handling. The affected API endpoint involves HTTP request headers, with the vulnerable parameter being proto. The vulnerable function is req.headersDistinct.Recommendations
Node.js versions 20.x: At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Node.js versions 22.x: At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Node.js versions 24.x: At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Node.js version v25.x: At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Allocation of Resources Without Limits
Improper Resource Release
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Node.Js
Rocky Linux