ZeroDay Findings
Sign inSign up

Findings

CVE-2026-21710

A flaw in Node.js HTTP request handling causes an uncaught when a request is received with a header named and the application accesses .

Published Mar 30, 2026 · updated Aug 19, 2026 · nodejs node.js

A flaw in Node.js HTTP request handling causes an uncaught when a request is received with a header named and the application accesses . When this occurs, resolves to rather than , causing to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by event listeners, meaning it cannot be handled without wrapping every access in a . * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 30, 2026 · NIST NVD

    Detected

    A flaw in Node.js HTTP request handling causes an uncaught when a request is received with a header named and the application accesses . When this occurs, resolves to rather than , causing to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by event listeners, meaning it cannot be handled without wrapping every access in a . * This

  2. Aug 19, 2026 · NIST NVD

    Updated

    A flaw in Node.js HTTP request handling causes an uncaught when a request is received with a header named and the application accesses . When this occurs, resolves to rather than , causing to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by event listeners, meaning it cannot be handled without wrapping every access in a . * This

Affected

  • cpe nodejs/node.jsversion unspecified
  • cpe redhat/enterprise linux10.0
  • cpe redhat/enterprise linux8.0
  • cpe redhat/enterprise linux9.0
  • cpe redhat/enterprise linux eus9.4

Sources

  • CVE.orgVulnerability recordCVE-2026-21710

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-21710

    A flaw in Node.js HTTP request handling causes an uncaught when a request is received with a header named and the application accesses . When this occurs, resolves to rather than , c

    nvd.nist.gov

References