CVE-2026-21710

A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**

• CWE-770
• CWE-843

• https://nodejs.org/en/blog/vulnerability/march-2026-security-releasesVendor Advisory
• https://access.redhat.com/errata/RHSA-2026:7080Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:7123Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:7302Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:7310Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:7350Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:7670Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:7675Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:7896Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:7983Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:8339Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:9711Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:9874Third Party Advisory
• https://access.redhat.com/security/cve/CVE-2026-21710Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2453151Issue Tracking
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21710.jsonThird Party Advisory

Published

Mar 30, 2026

Last Modified

Aug 19, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-21695Titra is open source project time tracking software. In vers…4.3
• CVE-2026-21696Wings is the server control plane for Pterodactyl, a free, o…6.5
• CVE-2026-21697axios4go is a Go HTTP client library. Prior to version 0.6.4…8.1
• CVE-2026-21708A vulnerability allowing a Backup Viewer to perform remote c…9.9
• CVE-2026-21709A vulnerability allowing a local attacker with administrator…6.7
• CVE-2026-2171A vulnerability was found in code-projects Online Student Ma…9.8
• CVE-2026-21711A flaw in Node.js Permission Model network enforcement leave…5.3
• CVE-2026-21712A flaw in Node.js URL processing causes an assertion failure…6.5
• CVE-2026-21713A flaw in Node.js HMAC verification uses a non-constant-time…5.9
• CVE-2026-21714A memory leak occurs in Node.js HTTP/2 servers when a client…5.3
• CVE-2026-21715A flaw in Node.js Permission Model filesystem enforcement le…3.3
• CVE-2026-21716An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmo…3.3