ZeroDay Findings
Sign inSign up

Findings

CVE-2026-21712

A flaw in Node.js URL processing causes an assertion failure in native code when is called with a malformed internationalized domain name (IDN) containing invalid char…

Published Mar 30, 2026 · updated Aug 19, 2026 · nodejs node.js

A flaw in Node.js URL processing causes an assertion failure in native code when is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 30, 2026 · NIST NVD

    Detected

    A flaw in Node.js URL processing causes an assertion failure in native code when is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.

  2. Aug 19, 2026 · NIST NVD

    Updated

    A flaw in Node.js URL processing causes an assertion failure in native code when is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.

Affected

  • cpe nodejs/node.jsversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-21712

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-21712

    A flaw in Node.js URL processing causes an assertion failure in native code when is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.

    nvd.nist.gov

References