A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 30, 2026 · NIST NVD

   Detected

   A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process. The most common trigger is any endpoint that calls on attacker-controlled input, as JSON

2. Aug 19, 2026 · NIST NVD

   Updated

   A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process. The most common trigger is any endpoint that calls on attacker-controlled input, as JSON

Affected

• cpe nodejs/node.jsversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-21717

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-21717

  A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade perfo

  nvd.nist.gov

References

• Vendor Advisory · nodejs.org