CVE-2026-21710

CVE-2026-21710 is a denial-of-service flaw (CWE-843 type confusion, also tagged CWE-770) in the HTTP request handling of Node.js release lines 20.x, 22.x, 24.x, and 25.x, triggered when a client sends a request with a header literally named `__proto__` and the application reads `req.headersDistinct`. Because the header collides with JavaScript's prototype mechanism, `dest["__proto__"]` resolves to Object.prototype instead of undefined, causing the code to call `.push()` on a non-array and throw a synchronous TypeError. The exception is thrown inside a property getter and is not routed through the request's `error` event, so an attacker's single crafted request crashes request handling and yields availability impact (CVSS 7.5, availability-only) unless every `req.headersDistinct` access is wrapped in try/catch. All applications running HTTP servers on affected Node.js versions are exposed, including Node.js as shipped in Red Hat Enterprise Linux and RHEL Extended Update Support (EUS), although only code paths that actually read `req.headersDistinct` can be crashed by this trigger. No public proof-of-concept or confirmed exploitation exists yet, but the EPSS score of 25% within 30 days (98th percentile) indicates elevated near-term exploitation risk.

What to do: Upgrade Node.js to the latest patched release published for your current release line (20.x, 22.x, 24.x, or 25.x) once fixes ship, and apply the corresponding updated nodejs packages from Red Hat advisories for RHEL and RHEL EUS systems. As interim mitigation, wrap every `req.headersDistinct` access in try/catch or reject/strip requests containing a `__proto__` header at a reverse proxy. Prioritize remediation given the high EPSS (25% probability of exploitation within 30 days).