Loading vulnerability…
Node.js HTTP __proto__ Header Denial of Service
CVE-2026-21710 is an HTTP request-handling vulnerability affecting unpatched Node.js 20.x, 22.x, 24.x, and 25.x releases. When a request contains a header named proto and application code accesses req.headersDistinct, the header aggregation logic resolves dest["proto"] to Object.prototype rather than undefined. It consequently attempts to call .push() on a non-array value, throwing a synchronous TypeError inside the property getter. Standard error event listeners cannot intercept this exception. If uncaught, the exception can terminate the Node.js process and cause denial of service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote, unauthenticated attacker can disrupt service availability by triggering an uncaught exception in an affected HTTP server. Process termination can interrupt other requests handled by the same process. Exploitation requires no user interaction and has low attack complexity. The vulnerability has a CVSS v3.1 score of 7.5, with high availability impact and no identified confidentiality or integrity impact.
If you can’t patch tonight, do this now.
Until patched, avoid accessing req.headersDistinct for untrusted requests where feasible. If access is necessary, wrap every access in try/catch and handle the exception without terminating the process; error event listeners alone are insufficient. As defense in depth, reject requests containing a header named proto at an HTTP-aware proxy or gateway before they reach the vulnerable application.
Patch, then assume compromise.
Upgrade Node.js to 20.20.2 or later in the 20.x branch, 22.22.2 or later in the 22.x branch, 24.14.1 or later in the 24.x branch, or 25.8.2 or later in the 25.x branch. For distribution-managed installations, apply the vendor-fixed package revision for the applicable platform; the specified Chainguard nodejs-22 remediation is 22.22.3-r0 or later. VMware Tanzu deployments using the affected NodeJS Buildpack should upgrade to version 1.9.0 or a later fixed release.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
38 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.