A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occu…
高危 CVSS 7.5
摘要
A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `re…
中文摘要建设中,暂以英文摘要呈现(DR-003 v2)。
深度研判
该漏洞尚未生成深度研判报告(DR-003 v2 AI pipeline 建设中)。
受影响产品
- :
- :
数据来源
- NVD DATABASE
原始链接
- https://nodejs.org/en/blog/vulnerability/march-2026-security-releases Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:7080 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:7123 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:7302 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:7310 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:7350 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:7670 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:7675 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:7896 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:7983 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:8339 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:9711 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:9874 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-21710 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2453151 Issue Tracking
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21710.json Third Party Advisory
时间线
- nvd_ingest NVD