CVE-2026-21710
Node.js: __proto__ header name crashes servers that read req.headersDistinct
Technology
Node.js
CVSS Score
7.5 / 10.0
Affected Versions
all versions to 20.20.1; 22.0.0 to 22.22.1; 24.0.0 to 24.14.0; 25.0.0 to 25.8.1
Upstream Fix
20.20.2; 22.22.2; 24.14.1; 25.8.2
Published
March 30, 2026
OSSeva Coverage
Fixed upstream
Description
A request with a header named __proto__ makes req.headersDistinct throw an uncaught TypeError inside a property getter, which error listeners cannot intercept, crashing the HTTP server process. Rated High by Node.js. Fixed in the March 2026 security releases: 20.20.2, 22.22.2, 24.14.1 and 25.8.2, the last Node.js 20 release.
Is your Node.js deployment affected?
If you're running all versions to 20.20.1; 22.0.0 to 22.22.1; 24.0.0 to 24.14.0; 25.0.0 to 25.8.1, you need this patch. Book a discovery call to get covered.