A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occu…
High CVSS 7.5
Summary
A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `re…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
- :
Sources
- NVD DATABASE
Original Links
- https://nodejs.org/en/blog/vulnerability/march-2026-security-releases Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:7080 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:7123 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:7302 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:7310 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:7350 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:7670 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:7675 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:7896 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:7983 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:8339 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:9711 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:9874 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-21710 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2453151 Issue Tracking
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21710.json Third Party Advisory
Timeline
- nvd_ingest NVD