Loading vulnerability…
CVE-2026-21710 is an uncaught-exception denial-of-service vulnerability in Node.js HTTP request handling. When an HTTP request contains a header named proto and application code accesses req.headersDistinct, construction of the distinct-header representation resolves the proto property through Object.prototype rather than as an undefined destination entry. Node.js then invokes push() on a non-array value, synchronously throwing a TypeError from the property getter. The exception cannot be handled by HTTP error event listeners.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small, self-contained proof-of-concept for CVE-2026-21710, a Node.js denial-of-service vulnerability involving req.headersDistinct. The repo contains three files: README.md documenting the issue and usage, server.js implementing a deliberately vulnerable HTTP server, and poc.js implementing the exploit. The exploit is not part of a larger framework. The main exploit capability is remote, unauthenticated DoS. poc.js uses Node's net module to open a raw TCP connection to 127.0.0.1:3000 and manually sends HTTP/1.1 requests. It first sends a benign request to verify availability, then sends a malicious request containing the header __proto__, and finally performs a follow-up request to confirm the server has crashed. The exploit relies on the target application accessing req.headersDistinct; when the malicious header is processed, the internal accumulator uses a plain object and dest["__proto__"] resolves to Object.prototype, causing .push() to throw a synchronous TypeError. The result is process termination unless a top-level uncaughtException handler prevents exit. server.js is a demonstration target rather than part of the exploit payload. It binds an HTTP server to 127.0.0.1:3000 and immediately accesses req.headersDistinct inside the request handler, making it vulnerable by design. A normal server error listener is present, but comments correctly note that this listener does not catch the vulnerable exception path. Overall, this is a genuine POC exploit repository with clear reproduction steps, minimal code, and no post-exploitation behavior beyond service crash verification. It does not provide persistence, code execution, or lateral movement; its sole purpose is to demonstrate and validate the crash condition for affected Node.js versions.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
35 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A denial-of-service vulnerability in Node.js caused by a crafted HTTP `__proto__` header.
A denial-of-service vulnerability in Node.js caused by a crafted HTTP __proto__ header.
A denial-of-service vulnerability in Node.js caused by a crafted HTTP `__proto__` header.
A Node.js denial-of-service vulnerability triggered by a crafted HTTP `__proto__` header.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.