CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

← All products

Node.js — security advisories

11 advisories4 sourceslatest 2026-08-17⚡ RSS feed

Every advisory CSIRTS.com has correlated to Node.js, newest first — across national CERTs, vendor PSIRTs and vulnerability databases.

⚡ Watch Node.js

Get an email when a new Node.js advisory drops — max one per day, one-click unsubscribe.

CVE-2026-21710: A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapp

highCVSS 7.5CVE-2026-21710msrc2026-08-06

CVE-2025-23167: A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests. The issue was resolved by upgrading `llhttp` to version 9, which enforces correct header termination. Impact: * This vulnerability affects only Node.js 20.x users prior to the `llhttp` v9 upgrade.

mediumCVSS 6.5CVE-2025-23167msrc2026-08-06