vulnti.work

A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occu…

高危 CVSS 7.5
CVECVE-2026-21710
首次发现2026-08-19 15:15 UTC
披露时间2026-03-30 20:16 UTC
最后更新2026-08-19 15:15 UTC
通道状态auto

摘要

A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `re…

中文摘要建设中,暂以英文摘要呈现(DR-003 v2)。

深度研判

该漏洞尚未生成深度研判报告(DR-003 v2 AI pipeline 建设中)。

受影响产品

  • :
  • :

数据来源

  • NVD DATABASE

原始链接

时间线

  1. nvd_ingest NVD