CVE-2026-21710: A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `proto` and the application accesses `req.headersDistinct`. When this occurs, `dest["proto"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapp

highCVSS 7.5CVE-2026-21710

CSIRTS triage

vendor: Node.js product: Node.js Code injection

What: HTTP request handling with a header named `__proto__` causes a TypeError and prototype pollution when `req.headersDistinct` is accessed.
Who is affected: All Node.js applications that process untrusted HTTP headers and access req.headersDistinct.
Urgency: High priority due to high CVSS score of 7.5 and risk of prototype pollution attacks.
Action: Update Node.js to the latest patched version.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Node.js

Get an email when a new Node.js advisory drops — max one per day, one-click unsubscribe.

Details

Source: Microsoft Security Response Center (INTL · vendor-psirt · site)
Severity: high — CVSS 7.5
Published: 2026-08-06
Exploitation: Not in CISA KEV at last sync

Original advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21710

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Elevated exploitation riskCVE-2026-2171025.0% 30-day exploitation probability — well above the norm. Schedule remediation this cycle. Riskier than 98% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-21710	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

medium[UPDATE] [medium] Node.js: Multiple vulnerabilitiescert-bund

Recent advisories for Node.js HTTP request

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCVE-2026-55553: urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and ot…nvd · 2026-08-25
mediumCVE-2025-23167: A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\r…msrc · 2026-08-06
lowCVE-2026-58044: A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwardi…nvd · 2026-08-04
unknownCVE-2026-67320: axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-co…nvd · 2026-08-01
unknownCVE-2026-67318: axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength li…nvd · 2026-08-01
mediumCVE-2026-14631: webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unau…nvd · 2026-07-03