open-flaw/cve-2026-21710Proof-of-concept exploit for CVE-2026-21710, a Node.js HTTP request handling flaw causing uncaught TypeError via __proto__ header, leading to denial of service.
| Field | Value |
|---|
| CVE ID | CVE-2026-21710 |
| Published | 2026-03-30 |
| CVSS v3.1 | 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) |
| CWE | CWE-770 — Allocation of Resources Without Limits or Throttling |
| Affected | Node.js 20.x, 22.x, 24.x, 25.x |
| Fixed in | March 2026 Security Releases |
A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request is received with a header named __proto__ and the application accesses req.headersDistinct.
dest["__proto__"] resolves to Object.prototype rather than undefined, causing .push() to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by error event listeners — it cannot be handled without wrapping every req.headersDistinct access in a try/catch.
The headersDistinct getter accumulates header values into a plain object:
const dest = {};
// ...
dest[name] = dest[name] || [];
dest[name].push(value);
When name === "__proto__":
dest["__proto__"] returns Object.prototype (truthy, not undefined)|| [] initialisation is skipped.push(value) is called on Object.prototype → TypeError: dest[name].push is not a function| File | Description |
|---|---|
server.js | Vulnerable HTTP server (accesses req.headersDistinct directly) |
poc.js | Proof-of-concept exploit |
For authorised security research / responsible disclosure only.
node server.js
# Listening on http://127.0.0.1:3000
node poc.js
Expected output:
__proto__ header is sent; server crashes with an uncaught TypeError.