open-flaw/cve-2026-21717Proof-of-concept for CVE-2026-21717, a Node.js V8 string hashing collision vulnerability causing denial of service via crafted JSON payloads.
Node.js V8 String Hashing Predictable Collision Vulnerability Leading to Denial of Service
A critical vulnerability in V8's string hashing mechanism allows attackers to cause severe performance degradation in Node.js applications. Integer-like strings are hashed to their numeric value, making hash collisions trivially predictable. By crafting malicious input that causes many collisions in V8's internal string table, an attacker can significantly degrade performance or cause a denial of service.
The vulnerability stems from V8's string internalization process. When JSON parsing occurs, short strings are automatically internalized into a hash table. Integer-like strings collide predictably because they hash to their numeric values, allowing attackers to force quadratic probing chains that severely degrade performance.
The most common trigger is any endpoint that calls JSON.parse() on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table.
This repository contains a proof-of-concept demonstrating the vulnerability:
# Use Node.js version affected by CVE-2026-21717
nvm use
npm install
node poc.js
The PoC creates a payload with:
JSON.parse() on the untrusted input// Limit payload size
app.use(express.json({ limit: '100kb' }));
// Add timeout for parsing
const parseWithTimeout = (str, timeout = 1000) => {
return Promise.race([
Promise.resolve(JSON.parse(str)),
new Promise((_, reject) =>
setTimeout(() => reject(new Error('Parse timeout')), timeout)
)
]);
};
This repository is for educational and research purposes only. Do not use this code for malicious purposes or against systems you do not own or have explicit permission to test.