Bug 2453151 (CVE-2026-21710) - CVE-2026-21710 Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header
Summary: CVE-2026-21710 Node.js: Node.js: Denial of Service due to crafted HTTP `__pro...
Keywords:
Status: NEW
Alias: CVE-2026-21710
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2453599 2453600 2453601
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-03-30 20:01 UTC by OSIDB Bzimport
Modified: 2026-04-22 21:44 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2026:8299 0 None None None 2026-04-15 12:35:01 UTC
Red Hat Product Errata RHBA-2026:8353 0 None None None 2026-04-15 22:24:00 UTC
Red Hat Product Errata RHSA-2026:7080 0 None None None 2026-04-08 13:54:45 UTC
Red Hat Product Errata RHSA-2026:7123 0 None None None 2026-04-08 18:05:03 UTC
Red Hat Product Errata RHSA-2026:7302 0 None None None 2026-04-09 12:47:11 UTC
Red Hat Product Errata RHSA-2026:7310 0 None None None 2026-04-09 13:20:07 UTC
Red Hat Product Errata RHSA-2026:7350 0 None None None 2026-04-09 20:20:42 UTC
Red Hat Product Errata RHSA-2026:7670 0 None None None 2026-04-13 02:47:48 UTC
Red Hat Product Errata RHSA-2026:7675 0 None None None 2026-04-13 02:23:18 UTC
Red Hat Product Errata RHSA-2026:7896 0 None None None 2026-04-13 18:29:26 UTC
Red Hat Product Errata RHSA-2026:7983 0 None None None 2026-04-14 06:52:18 UTC
Red Hat Product Errata RHSA-2026:8339 0 None None None 2026-04-15 19:04:58 UTC
Red Hat Product Errata RHSA-2026:9711 0 None None None 2026-04-22 13:57:50 UTC
Red Hat Product Errata RHSA-2026:9874 0 None None None 2026-04-22 21:44:52 UTC

Description OSIDB Bzimport 2026-03-30 20:01:45 UTC 
A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.

When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`.

* This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**
Comment 3 errata-xmlrpc 2026-04-08 13:54:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:7080 https://access.redhat.com/errata/RHSA-2026:7080
Comment 4 errata-xmlrpc 2026-04-08 18:05:01 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:7123 https://access.redhat.com/errata/RHSA-2026:7123
Comment 5 errata-xmlrpc 2026-04-09 12:47:10 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:7302 https://access.redhat.com/errata/RHSA-2026:7302
Comment 6 errata-xmlrpc 2026-04-09 13:20:06 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:7310 https://access.redhat.com/errata/RHSA-2026:7310
Comment 7 errata-xmlrpc 2026-04-09 20:20:41 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:7350 https://access.redhat.com/errata/RHSA-2026:7350
Comment 9 errata-xmlrpc 2026-04-13 02:23:17 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:7675 https://access.redhat.com/errata/RHSA-2026:7675
Comment 10 errata-xmlrpc 2026-04-13 02:47:46 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:7670 https://access.redhat.com/errata/RHSA-2026:7670
Comment 12 errata-xmlrpc 2026-04-13 18:29:24 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:7896 https://access.redhat.com/errata/RHSA-2026:7896
Comment 13 errata-xmlrpc 2026-04-14 06:52:16 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:7983 https://access.redhat.com/errata/RHSA-2026:7983
Comment 14 errata-xmlrpc 2026-04-15 19:04:57 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:8339 https://access.redhat.com/errata/RHSA-2026:8339
Comment 15 errata-xmlrpc 2026-04-22 13:57:48 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2026:9711 https://access.redhat.com/errata/RHSA-2026:9711
Comment 17 errata-xmlrpc 2026-04-22 21:44:51 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:9874 https://access.redhat.com/errata/RHSA-2026:9874
Note You need to log in before you can comment on or make changes to this bug.