CVE-2026-21710

Description

A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.

When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`.

* This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**

Affected products

Vendor	Product	Affected	Fixed
nodejs	node	20.20.1 – ≤ 20.20.1, 22.22.1 – ≤ 22.22.1, 24.14.0 – ≤ 24.14.0, 25.8.1 – ≤ 25.8.1, 4.0 – < 4., 5.0 – < 5., 6.0 – < 6., 7.0 – < 7., 8.0 – < 8., 9.0 – < 9., 10.0 – < 10., 11.0 – < 11., 12.0 – < 12., 13.0 – < 13., 14.0 – < 14., 15.0 – < 15., 16.0 – < 16., 17.0 – < 17., 18.0 – < 18.*, 19.0…	4.*

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	nodejs	22.22.2+dfsg+~cs22.19.15-1	—
Debian 13	nodejs	20.19.2+dfsg-1+deb13u2	DSA-6183-1
Debian 12	nodejs	18.20.4+dfsg-1~deb12u2	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 26.10	nodejs	No fix yet	—
Ubuntu 26.04 LTS	nodejs	No fix yet	—
Ubuntu 25.10	nodejs	No fix yet	—
Ubuntu 24.04 LTS	nodejs	No fix yet	—

Show 5 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 22.04 LTS	nodejs	No fix yet	—
Ubuntu Pro 20.04 LTS	nodejs	No fix yet	—
Ubuntu Pro 18.04 LTS	nodejs	No fix yet	—
Ubuntu Pro 16.04 LTS	nodejs	No fix yet	—
Ubuntu Pro 14.04 LTS	nodejs	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 10	nodejs +5	1:22.22.2-1.el10_1	RHSA-2026:7080
RHEL 10	nodejs-npm	1:10.9.7-1.22.22.2.1.el10_1	RHSA-2026:7080
RHEL 10	nodejs24 +4	1:24.14.1-2.el10_1	RHSA-2026:7675
RHEL 10	nodejs24-npm	1:11.11.0-1.24.14.1.2.el10_1	RHSA-2026:7675
RHEL 9	nodejs +3	1:20.20.2-1.module+el9.7.0+24193+41b7b572	RHSA-2026:7896, RHSA-2026:7350, RHSA-2026:7302
RHEL 9	nodejs-libs	1:22.22.2-1.module+el9.7.0+24157+8ddb2461	RHSA-2026:7350, RHSA-2026:7302
RHEL 9	nodejs-nodemon	3.0.1-1.module+el9.7.0+24157+8ddb2461	RHSA-2026:7896, RHSA-2026:7350, RHSA-2026:7302
RHEL 9	nodejs-packaging +1	2021.06-6.module+el9.7.0+24157+8ddb2461	RHSA-2026:7896, RHSA-2026:7350, RHSA-2026:7302
RHEL 9	npm	1:10.8.2-1.20.20.2.1.module+el9.7.0+24193+41b7b572	RHSA-2026:7896, RHSA-2026:7350, RHSA-2026:7302
RHEL 9	v8-12.4-devel	3:12.4.254.21-1.22.22.2.1.module+el9.7.0+24157+8ddb2461	RHSA-2026:7302
RHEL 9	v8-13.6-devel	3:13.6.233.17-1.24.14.1.2.module+el9.7.0+24166+51c9666b	RHSA-2026:7350
RHEL 8	nodejs +3	1:20.20.2-1.module+el8.10.0+24197+1602b452	RHSA-2026:8339, RHSA-2026:7670, RHSA-2026:7123
RHEL 8	nodejs-libs	1:22.22.2-1.module+el8.10.0+24148+847b6786	RHSA-2026:7670, RHSA-2026:7123
RHEL 8	nodejs-nodemon	3.0.1-1.module+el8.10.0+23521+490ebfde	RHSA-2026:8339, RHSA-2026:7670, RHSA-2026:7123
RHEL 8	nodejs-packaging +1	2021.06-6.module+el8.10.0+24148+847b6786	RHSA-2026:8339, RHSA-2026:7670, RHSA-2026:7123
RHEL 8	npm	1:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452	RHSA-2026:8339, RHSA-2026:7670, RHSA-2026:7123
RHEL 8	v8-12.4-devel	3:12.4.254.21-1.22.22.2.1.module+el8.10.0+24148+847b6786	RHSA-2026:7123
RHEL 8	v8-13.6-devel	3:13.6.233.17-1.24.14.1.2.module+el8.10.0+24190+49a46c75	RHSA-2026:7670

Show 3 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 10.0 EUS	nodejs +5	1:22.22.2-2.el10_0	RHSA-2026:7310
RHEL 10.0 EUS	nodejs-npm	1:10.9.7-1.22.22.2.2.el10_0	RHSA-2026:7310
RHEL 9.6 EUS	nodejs +3	1:20.20.2-2.module+el9.6.0+24220+c44c288d	RHSA-2026:9874, RHSA-2026:7983
RHEL 9.6 EUS	nodejs-libs	1:22.22.2-1.module+el9.6.0+24196+39669d4e	RHSA-2026:7983
RHEL 9.6 EUS	nodejs-nodemon	3.0.1-1.module+el9.6.0+23146+be9976bd	RHSA-2026:9874, RHSA-2026:7983
RHEL 9.6 EUS	nodejs-packaging +1	2021.06-4.module+el9.6.0+23146+be9976bd	RHSA-2026:9874, RHSA-2026:7983
RHEL 9.6 EUS	npm	1:10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d	RHSA-2026:9874, RHSA-2026:7983
RHEL 9.6 EUS	v8-12.4-devel	3:12.4.254.21-1.22.22.2.1.module+el9.6.0+24196+39669d4e	RHSA-2026:7983
RHEL 9.4 EUS	nodejs +3	1:20.20.2-2.module+el9.4.0+24216+64c58546	RHSA-2026:9711
RHEL 9.4 EUS	nodejs-nodemon	3.0.1-1.module+el9.3.0.z+20478+84a9f781	RHSA-2026:9711
RHEL 9.4 EUS	nodejs-packaging +1	2021.06-4.module+el9.3.0+19518+63aad52d	RHSA-2026:9711
RHEL 9.4 EUS	npm	1:10.8.2-1.20.20.2.2.module+el9.4.0+24216+64c58546	RHSA-2026:9711

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 10	nodejs-docs	1:22.22.2-1.el10_1	ALSA-2026:7080
AlmaLinux 10	nodejs24-docs	1:24.14.1-2.el10_1	ALSA-2026:7675
AlmaLinux 10	nodejs24-npm	1:11.11.0-1.24.14.1.2.el10_1	ALSA-2026:7675
AlmaLinux 9	nodejs	1:20.20.2-1.module_el9.7.0+226+88d36870	ALSA-2026:7896, ALSA-2026:7350
AlmaLinux 9	nodejs-docs +2	1:20.20.2-1.module_el9.7.0+224+0af7cc6b	ALSA-2026:7896, ALSA-2026:7350
AlmaLinux 9	nodejs-libs	1:24.14.1-2.module_el9.7.0+222+ef1c61e1	ALSA-2026:7350
AlmaLinux 9	nodejs-nodemon	3.0.1-1.module_el9.5.0+125+8dc38870	ALSA-2026:7896, ALSA-2026:7350
AlmaLinux 9	nodejs-packaging	2021.06-6.module_el9.7.0+209+ecf6523e	ALSA-2026:7896, ALSA-2026:7350
AlmaLinux 9	nodejs-packaging-bundler	2021.06-6.module_el9.7.0+198+8bf605ba	ALSA-2026:7896, ALSA-2026:7350
AlmaLinux 9	npm	1:10.8.2-1.20.20.2.1.module_el9.7.0+224+0af7cc6b	ALSA-2026:7896, ALSA-2026:7350
AlmaLinux 9	v8-13.6-devel	3:13.6.233.17-1.24.14.1.2.module_el9.7.0+222+ef1c61e1	ALSA-2026:7350
AlmaLinux 8	nodejs +3	1:20.20.2-1.module_el8.10.0+4165+3f200bda	ALSA-2026:8339, ALSA-2026:7670, ALSA-2026:7123
AlmaLinux 8	nodejs-libs	1:22.22.2-1.module_el8.10.0+4158+e796f37f	ALSA-2026:7670, ALSA-2026:7123
AlmaLinux 8	nodejs-nodemon	3.0.1-1.module_el8.10.0+3982+85c136aa	ALSA-2026:8339, ALSA-2026:7670, ALSA-2026:7123
AlmaLinux 8	nodejs-packaging +1	2021.06-6.module_el8.10.0+4086+70facd4a	ALSA-2026:8339, ALSA-2026:7670, ALSA-2026:7123
AlmaLinux 8	npm	1:10.8.2-1.20.20.2.1.module_el8.10.0+4165+3f200bda	ALSA-2026:8339, ALSA-2026:7670, ALSA-2026:7123
AlmaLinux 8	v8-12.4-devel	3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f	ALSA-2026:7123
AlmaLinux 8	v8-13.6-devel	3:13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42	ALSA-2026:7670

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 10	nodejs22	1:22.22.2-1.el10_1	RLSA-2026:7080
Rocky Linux 10	nodejs24	1:24.14.1-2.el10_1	RLSA-2026:7675
Rocky Linux 9	nodejs-nodemon	3.0.1-1.module+el9.7.0+40017+f0db1785	RLSA-2026:7896, RLSA-2026:7350, RLSA-2026:7302
Rocky Linux 9	nodejs-packaging	2021.06-6.module+el9.7.0+40052+e32ea525	RLSA-2026:7896, RLSA-2026:7350, RLSA-2026:7302
Rocky Linux 8	nodejs-nodemon	3.0.1-1.module+el8.9.0+1760+903d54b9	RLSA-2026:8339, RLSA-2026:7670, RLSA-2026:7123
Rocky Linux 8	nodejs-packaging	2021.06-6.module+el8.10.0+40048+6d99f608	RLSA-2026:8339, RLSA-2026:7670, RLSA-2026:7123

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP7	nodejs22	22.22.2-150700.3.9.1	SUSE-SU-2026:1478-1
SLES 15 SP7	nodejs24	24.14.1-150700.15.8.1	SUSE-SU-2026:1299-1
SLES 15 SP6	nodejs20	20.20.2-150600.3.18.1	SUSE-SU-2026:1363-1
SLES 15 SP6	nodejs22	22.22.2-150600.13.15.1	SUSE-SU-2026:1509-1
SLES 15 SP5	nodejs18	18.20.8-150400.9.39.1	SUSE-SU-2026:4261-1
SLES 15 SP5	nodejs20	20.20.2-150500.11.27.1	SUSE-SU-2026:1371-1
SLES 15 SP4	nodejs16	16.20.2-150400.3.42.1	SUSE-SU-2026:4355-1
SLES 15 SP4	nodejs18	18.20.8-150400.9.39.1	SUSE-SU-2026:4261-1
SLES 12 SP5	nodejs18	18.20.8-8.44.1	SUSE-SU-2026:4248-1

Show 7 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 16.0	nodejs22	22.23.0-160000.1.1	SUSE-SU-2026:22368-1
SLES for SAP 16.0	nodejs24	24.14.1-160000.1.1	SUSE-SU-2026:21181-1
SLES for SAP 15 SP6	nodejs20	20.20.2-150600.3.18.1	SUSE-SU-2026:1363-1
SLES for SAP 15 SP6	nodejs22	22.22.2-150600.13.15.1	SUSE-SU-2026:1509-1
SLES for SAP 15 SP5	nodejs18	18.20.8-150400.9.39.1	SUSE-SU-2026:4261-1
SLES for SAP 15 SP5	nodejs20	20.20.2-150500.11.27.1	SUSE-SU-2026:1371-1
SLES for SAP 15 SP4	nodejs16	16.20.2-150400.3.42.1	SUSE-SU-2026:4355-1
SLES for SAP 15 SP4	nodejs18	18.20.8-150400.9.39.1	SUSE-SU-2026:4261-1
SLES 16.0	nodejs22	22.23.0-160000.1.1	SUSE-SU-2026:22368-1
SLES 16.0	nodejs24	24.14.1-160000.1.1	SUSE-SU-2026:21181-1
SLE HPC 15 SP5	nodejs18	18.20.8-150400.9.39.1	SUSE-SU-2026:4261-1
SLE HPC 15 SP5	nodejs20	20.20.2-150500.11.27.1	SUSE-SU-2026:1371-1
SLE HPC 15 SP4	nodejs16	16.20.2-150400.3.42.1	SUSE-SU-2026:4355-1
SLE HPC 15 SP4	nodejs18	18.20.8-150400.9.39.1	SUSE-SU-2026:4261-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	nodejs24	24.14.1-1.1	openSUSE-SU-2026:10504-1
openSUSE Tumbleweed	nodejs26	26.3.1-1.1	openSUSE-SU-2026:11110-1
openSUSE Leap 16.0	nodejs22	22.23.0-160000.1.1	openSUSE-SU-2026:21058-1
openSUSE Leap 16.0	nodejs24	24.14.1-160000.1.1	openSUSE-SU-2026:20519-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	nodejs	24.14.1-r0	—
Alpine v3.23	nodejs	24.14.1-r0	—
Alpine v3.22	nodejs	22.22.2-r0	—
Alpine v3.21	nodejs	22.22.2-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	nodejs20 +4	1:20.20.2-1.amzn2023.0.1	ALAS2023-2026-1577
Amazon Linux 2023	nodejs20-npm	1:10.8.2-1.20.20.2.1.amzn2023.0.1	ALAS2023-2026-1577
Amazon Linux 2023	nodejs22 +4	1:22.22.2-1.amzn2023.0.1	ALAS2023-2026-1576
Amazon Linux 2023	nodejs22-npm	1:10.9.7-1.22.22.2.1.amzn2023.0.1	ALAS2023-2026-1576
Amazon Linux 2023	nodejs24 +4	1:24.14.1-1.amzn2023.0.1	ALAS2023-2026-1578
Amazon Linux 2023	nodejs24-npm	1:11.11.0-1.24.14.1.1.amzn2023.0.1	ALAS2023-2026-1578
Amazon Linux 2023	v8-11.3-devel	3:11.3.244.8-1.20.20.2.1.amzn2023.0.1	ALAS2023-2026-1577
Amazon Linux 2023	v8-12.4-devel	3:12.4.254.21-1.22.22.2.1.amzn2023.0.1	ALAS2023-2026-1576
Amazon Linux 2023	v8-13.6-devel	3:13.6.233.17-1.24.14.1.1.amzn2023.0.1	ALAS2023-2026-1578

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 3	nodejs	20.14.0-15	—
Azure Linux 3	nodejs24	24.14.1-1	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 10	nodejs +4	1:22.22.2-1.el10_1	ELSA-2026-7080
Oracle Linux 10	nodejs-npm	1:10.9.7-1.22.22.2.1.el10_1	ELSA-2026-7080
Oracle Linux 10	nodejs24 +4	1:24.14.1-2.0.2.el10_1	ELSA-2026-7675
Oracle Linux 10	nodejs24-npm	1:11.11.0-1.24.14.1.2.0.2.el10_1	ELSA-2026-7675
Oracle Linux 9	nodejs +3	1:20.20.2-1.module+el9.7.0+90874+6d84790f	ELSA-2026-7896, ELSA-2026-7350, ELSA-2026-7302
Oracle Linux 9	nodejs-libs	1:22.22.2-1.module+el9.7.0+90867+2ede48fe	ELSA-2026-7350, ELSA-2026-7302
Oracle Linux 9	nodejs-nodemon	3.0.1-1.module+el9.7.0+90867+2ede48fe	ELSA-2026-7896, ELSA-2026-7350, ELSA-2026-7302
Oracle Linux 9	nodejs-packaging +1	2021.06-6.module+el9.7.0+90866+5a953a4c	ELSA-2026-7896, ELSA-2026-7350, ELSA-2026-7302
Oracle Linux 9	npm	1:10.8.2-1.20.20.2.1.module+el9.7.0+90874+6d84790f	ELSA-2026-7896, ELSA-2026-7350, ELSA-2026-7302
Oracle Linux 9	v8-12.4-devel	3:12.4.254.21-1.22.22.2.1.module+el9.7.0+90867+2ede48fe	ELSA-2026-7302
Oracle Linux 9	v8-13.6-devel	3:13.6.233.17-1.24.14.1.2.module+el9.7.0+90866+5a953a4c	ELSA-2026-7350
Oracle Linux 8	nodejs +3	1:20.20.2-1.module+el8.10.0+90878+0d41f8c0	ELSA-2026-8339, ELSA-2026-7670, ELSA-2026-7123
Oracle Linux 8	nodejs-libs	1:22.22.2-1.module+el8.10.0+90865+d647ef3a	ELSA-2026-7670, ELSA-2026-7123
Oracle Linux 8	nodejs-nodemon	3.0.1-1.module+el8.10.0+90743+b61054a8	ELSA-2026-8339, ELSA-2026-7670, ELSA-2026-7123
Oracle Linux 8	nodejs-packaging +1	2021.06-4.module+el8.10.0+90865+d647ef3a	ELSA-2026-8339, ELSA-2026-7670, ELSA-2026-7123
Oracle Linux 8	npm	1:10.8.2-1.20.20.2.1.module+el8.10.0+90878+0d41f8c0	ELSA-2026-8339, ELSA-2026-7670, ELSA-2026-7123
Oracle Linux 8	v8-12.4-devel	3:12.4.254.21-1.22.22.2.1.module+el8.10.0+90865+d647ef3a	ELSA-2026-7123
Oracle Linux 8	v8-13.6-devel	3:13.6.233.17-1.24.14.1.2.module+el8.10.0+90873+35652ecc	ELSA-2026-7670

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	nodejs-16 +3	No fix yet	—
Wolfi rolling	nodejs-22	22.22.3-r0	—

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

open-flaw/CVE-2026-21710 ★ 0 · Apr 1, 2026

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 50

WID-SEC-2026-0843 Node.js: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
ALSA-2026:7896 Important: nodejs:20 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:7350 Important: nodejs:24 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:7675 Important: nodejs24 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:7080 Important: nodejs22 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:7670 Important: nodejs:24 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:7123 Important: nodejs:22 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:8339 Important: nodejs:20 security update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2026:9711 Red Hat Security Advisory: nodejs:20 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:9874 Red Hat Security Advisory: nodejs:20 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:8339 Red Hat Security Advisory: nodejs:20 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:7983 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:7896 Red Hat Security Advisory: nodejs:20 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:7675 Red Hat Security Advisory: nodejs24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:7670 Red Hat Security Advisory: nodejs:24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:7350 Red Hat Security Advisory: nodejs:24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:7302 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:7310 Red Hat Security Advisory: nodejs22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:7123 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:7080 Red Hat Security Advisory: nodejs22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
SUSE-SU-2026:4355-1 Security update for nodejs16 SUSE / openSUSE Security Updates · Sep 29, 2026
SUSE-SU-2026:4261-1 Security update for nodejs18 SUSE / openSUSE Security Updates · Sep 18, 2026
SUSE-SU-2026:4248-1 Security update for nodejs18 SUSE / openSUSE Security Updates · Sep 18, 2026
SUSE-SU-2026:22368-1 Security update for nodejs22 SUSE / openSUSE Security Updates · Jul 2, 2026
openSUSE-SU-2026:21058-1 Security update for nodejs22 SUSE / openSUSE Security Updates · Jun 30, 2026
openSUSE-SU-2026:11110-1 nodejs26-26.3.1-1.1 on GA media SUSE / openSUSE Security Updates · Jun 24, 2026
ELSA-2026-7675 Important: nodejs24 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jun 9, 2026
openSUSE-SU-2026:20519-1 Security update for nodejs24 SUSE / openSUSE Security Updates · Apr 22, 2026
SUSE-SU-2026:21181-1 Security update for nodejs24 SUSE / openSUSE Security Updates · Apr 22, 2026
SUSE-SU-2026:1509-1 Security update for nodejs22 SUSE / openSUSE Security Updates · Apr 22, 2026
SUSE-SU-2026:1478-1 Security update for nodejs22 SUSE / openSUSE Security Updates · Apr 21, 2026
ELSA-2026-8339 Important: nodejs:20 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Apr 17, 2026
SUSE-SU-2026:1363-1 Security update for nodejs20 SUSE / openSUSE Security Updates · Apr 16, 2026
SUSE-SU-2026:1371-1 Security update for nodejs20 SUSE / openSUSE Security Updates · Apr 16, 2026
RLSA-2026:8339 Important: nodejs:20 security update Rocky Linux Security Advisories · Apr 16, 2026
RLSA-2026:7675 Important: nodejs24 security update Rocky Linux Security Advisories · Apr 15, 2026
SUSE-SU-2026:1299-1 Security update for nodejs24 SUSE / openSUSE Security Updates · Apr 14, 2026
RLSA-2026:7896 Important: nodejs:20 security update Rocky Linux Security Advisories · Apr 14, 2026
ELSA-2026-7896 Important: nodejs:20 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Apr 14, 2026
ALAS2023-2026-1576 Important: nodejs22 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 13, 2026
ALAS2023-2026-1577 Important: nodejs20 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 13, 2026
ALAS2023-2026-1578 Important: nodejs24 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 13, 2026
RLSA-2026:7670 Important: nodejs:24 security update Rocky Linux Security Advisories · Apr 13, 2026
ELSA-2026-7670 Important: nodejs:24 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Apr 13, 2026
RLSA-2026:7080 Important: nodejs22 security update Rocky Linux Security Advisories · Apr 12, 2026
RLSA-2026:7350 Important: nodejs:24 security update Rocky Linux Security Advisories · Apr 10, 2026
ELSA-2026-7350 Important: nodejs:24 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Apr 10, 2026
ELSA-2026-7302 Important: nodejs:22 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Apr 10, 2026
RLSA-2026:7302 Important: nodejs:22 security update Rocky Linux Security Advisories · Apr 9, 2026
openSUSE-SU-2026:10504-1 corepack24-24.14.1-1.1 on GA media SUSE / openSUSE Security Updates · Apr 9, 2026

References

https://nodejs.org/en/blog/vulnerability/march-2026-security-releases

CNA	v3.0	7.5
EUVD	v3.1	7.5
redhat-SADP	v3.1	7.5

A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the a…

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

AlmaLinux

Rocky Linux

SUSE

openSUSE

Alpine

Amazon Linux

Azure Linux

Oracle Linux

Wolfi

Public exploits

GitHub 1 repository

Advisories 50

References

A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `proto` and the a…