CVE-2026-21717

Name
CVE-2026-21717
Description
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process. The most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
support@hackerone.com https://nodejs.org/en/blog/vulnerability/march-2026-security-releases

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* nodejs >= None <= 20.20.1
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* nodejs >= 22.0.0 <= 22.22.1
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* nodejs >= 24.0.0 <= 24.14.0
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* nodejs >= 25.0.0 <= 25.8.1

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
nodejs edge-main 24.14.1-r0 Jakub Jirutka <jakub@jirutka.cz> fixed
nodejs edge-main 24.14.0-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 24.14.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 24.13.0-r3 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 24.13.0-r2 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 24.13.0-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 24.13.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 24.11.1-r2 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 24.11.1-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 24.11.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.21.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.19.0-r4 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.19.0-r3 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.16.0-r3 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.16.0-r2 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.16.0-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.16.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.13.1-r5 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.13.1-r4 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.13.1-r3 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.13.1-r2 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.13.1-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.13.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.11.0-r2 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.11.0-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 22.11.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 20.15.1-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 20.15.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 20.13.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 20.12.2-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 20.12.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 20.12.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 20.11.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 20.11.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 20.10.0-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 20.10.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 20.9.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 18.18.2-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 18.18.2-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 18.18.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 18.18.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 18.17.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 18.17.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 18.16.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 18.16.0-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 18.16.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 18.15.0-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 18.15.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 18.14.2-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 18.14.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 18.14.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 18.13.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 18.12.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 16.18.0-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 16.18.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 16.17.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 16.17.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 16.16.0-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 16.16.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 16.13.2-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 14.18.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 14.17.6-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 14.17.5-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 14.17.4-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 14.16.1-r0 None possibly vulnerable
nodejs edge-main 14.16.0-r0 None possibly vulnerable
nodejs edge-main 14.15.5-r0 None possibly vulnerable
nodejs edge-main 14.15.4-r0 None possibly vulnerable
nodejs edge-main 14.15.1-r0 None possibly vulnerable
nodejs edge-main 12.18.4-r0 None possibly vulnerable
nodejs edge-main 12.18.0-r0 None possibly vulnerable
nodejs edge-main 12.15.0-r0 None possibly vulnerable
nodejs edge-main 10.16.3-r0 None possibly vulnerable
nodejs edge-main 10.15.3-r0 None possibly vulnerable
nodejs edge-main 10.14.0-r0 None possibly vulnerable
nodejs edge-main 8.11.4-r0 None possibly vulnerable
nodejs edge-main 8.11.3-r0 None possibly vulnerable
nodejs edge-main 8.11.0-r0 None possibly vulnerable
nodejs edge-main 8.9.3-r0 None possibly vulnerable
nodejs edge-main 6.11.5-r0 None possibly vulnerable
nodejs edge-main 6.11.1-r0 None possibly vulnerable
nodejs 3.23-main 24.14.1-r0 Jakub Jirutka <jakub@jirutka.cz> fixed
nodejs 3.23-main 24.13.0-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.23-main 24.13.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.23-main 24.11.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.22-main 22.22.2-r0 Jakub Jirutka <jakub@jirutka.cz> fixed
nodejs 3.22-main 22.22.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.22-main 22.16.0-r2 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.22-main 22.13.1-r0 None possibly vulnerable
nodejs 3.22-main 20.15.1-r0 None possibly vulnerable
nodejs 3.22-main 20.12.1-r0 None possibly vulnerable
nodejs 3.22-main 18.18.2-r0 None possibly vulnerable
nodejs 3.22-main 18.17.1-r0 None possibly vulnerable
nodejs 3.22-main 18.14.1-r0 None possibly vulnerable
nodejs 3.22-main 18.12.1-r0 None possibly vulnerable
nodejs 3.22-main 16.17.1-r0 None possibly vulnerable
nodejs 3.22-main 16.13.2-r0 None possibly vulnerable
nodejs 3.22-main 14.18.1-r0 None possibly vulnerable
nodejs 3.22-main 14.17.6-r0 None possibly vulnerable
nodejs 3.22-main 14.17.5-r0 None possibly vulnerable
nodejs 3.22-main 14.17.4-r0 None possibly vulnerable
nodejs 3.22-main 14.16.1-r0 None possibly vulnerable
nodejs 3.22-main 14.16.0-r0 None possibly vulnerable
nodejs 3.22-main 14.15.5-r0 None possibly vulnerable
nodejs 3.22-main 14.15.4-r0 None possibly vulnerable
nodejs 3.22-main 14.15.1-r0 None possibly vulnerable
nodejs 3.22-main 12.18.4-r0 None possibly vulnerable
nodejs 3.22-main 12.18.0-r0 None possibly vulnerable
nodejs 3.22-main 12.15.0-r0 None possibly vulnerable
nodejs 3.22-main 10.16.3-r0 None possibly vulnerable
nodejs 3.22-main 10.15.3-r0 None possibly vulnerable
nodejs 3.22-main 10.14.0-r0 None possibly vulnerable
nodejs 3.22-main 8.11.4-r0 None possibly vulnerable
nodejs 3.22-main 8.11.3-r0 None possibly vulnerable
nodejs 3.22-main 8.11.0-r0 None possibly vulnerable
nodejs 3.22-main 8.9.3-r0 None possibly vulnerable
nodejs 3.22-main 6.11.5-r0 None possibly vulnerable
nodejs 3.22-main 6.11.1-r0 None possibly vulnerable
nodejs 3.21-main 22.22.2-r0 Jakub Jirutka <jakub@jirutka.cz> fixed
nodejs 3.21-main 22.15.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.21-main 22.13.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.21-main 22.11.0-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.21-main 22.11.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.21-main 20.15.1-r0 None possibly vulnerable
nodejs 3.21-main 20.12.1-r0 None possibly vulnerable
nodejs 3.21-main 18.18.2-r0 None possibly vulnerable
nodejs 3.21-main 18.17.1-r0 None possibly vulnerable
nodejs 3.21-main 18.14.1-r0 None possibly vulnerable
nodejs 3.21-main 18.12.1-r0 None possibly vulnerable
nodejs 3.21-main 16.17.1-r0 None possibly vulnerable
nodejs 3.21-main 16.13.2-r0 None possibly vulnerable
nodejs 3.21-main 14.18.1-r0 None possibly vulnerable
nodejs 3.21-main 14.17.6-r0 None possibly vulnerable
nodejs 3.21-main 14.17.5-r0 None possibly vulnerable
nodejs 3.21-main 14.17.4-r0 None possibly vulnerable
nodejs 3.21-main 14.16.1-r0 None possibly vulnerable
nodejs 3.21-main 14.16.0-r0 None possibly vulnerable
nodejs 3.21-main 14.15.5-r0 None possibly vulnerable
nodejs 3.21-main 14.15.4-r0 None possibly vulnerable
nodejs 3.21-main 14.15.1-r0 None possibly vulnerable
nodejs 3.21-main 12.18.4-r0 None possibly vulnerable
nodejs 3.21-main 12.18.0-r0 None possibly vulnerable
nodejs 3.21-main 12.15.0-r0 None possibly vulnerable
nodejs 3.21-main 10.16.3-r0 None possibly vulnerable
nodejs 3.21-main 10.15.3-r0 None possibly vulnerable
nodejs 3.21-main 10.14.0-r0 None possibly vulnerable
nodejs 3.21-main 8.11.4-r0 None possibly vulnerable
nodejs 3.21-main 8.11.3-r0 None possibly vulnerable
nodejs 3.21-main 8.11.0-r0 None possibly vulnerable
nodejs 3.21-main 8.9.3-r0 None possibly vulnerable
nodejs 3.21-main 6.11.5-r0 None possibly vulnerable
nodejs 3.21-main 6.11.1-r0 None possibly vulnerable
nodejs 3.20-main 20.15.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.20-main 20.13.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.20-main 20.12.1-r0 None possibly vulnerable
nodejs 3.20-main 18.18.2-r0 None possibly vulnerable
nodejs 3.20-main 18.17.1-r0 None possibly vulnerable
nodejs 3.20-main 18.14.1-r0 None possibly vulnerable
nodejs 3.20-main 18.12.1-r0 None possibly vulnerable
nodejs 3.20-main 16.17.1-r0 None possibly vulnerable
nodejs 3.20-main 16.13.2-r0 None possibly vulnerable
nodejs 3.20-main 14.18.1-r0 None possibly vulnerable
nodejs 3.20-main 14.17.6-r0 None possibly vulnerable
nodejs 3.20-main 14.17.5-r0 None possibly vulnerable
nodejs 3.20-main 14.17.4-r0 None possibly vulnerable
nodejs 3.20-main 14.16.1-r0 None possibly vulnerable
nodejs 3.20-main 14.16.0-r0 None possibly vulnerable
nodejs 3.20-main 14.15.5-r0 None possibly vulnerable
nodejs 3.20-main 14.15.4-r0 None possibly vulnerable
nodejs 3.20-main 14.15.1-r0 None possibly vulnerable
nodejs 3.20-main 12.18.4-r0 None possibly vulnerable
nodejs 3.20-main 12.18.0-r0 None possibly vulnerable
nodejs 3.20-main 12.15.0-r0 None possibly vulnerable
nodejs 3.20-main 10.16.3-r0 None possibly vulnerable
nodejs 3.20-main 10.15.3-r0 None possibly vulnerable
nodejs 3.20-main 10.14.0-r0 None possibly vulnerable
nodejs 3.20-main 8.11.4-r0 None possibly vulnerable
nodejs 3.20-main 8.11.3-r0 None possibly vulnerable
nodejs 3.20-main 8.11.0-r0 None possibly vulnerable
nodejs 3.20-main 8.9.3-r0 None possibly vulnerable
nodejs 3.20-main 6.11.5-r0 None possibly vulnerable
nodejs 3.20-main 6.11.1-r0 None possibly vulnerable
nodejs 3.19-main 20.15.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.19-main 20.12.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.19-main 20.11.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.19-main 20.11.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.19-main 20.10.0-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.19-main 20.10.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs 3.19-main 18.18.2-r0 None possibly vulnerable
nodejs 3.19-main 18.17.1-r0 None possibly vulnerable
nodejs 3.19-main 18.14.1-r0 None possibly vulnerable
nodejs 3.19-main 18.12.1-r0 None possibly vulnerable
nodejs 3.19-main 16.17.1-r0 None possibly vulnerable
nodejs 3.19-main 16.13.2-r0 None possibly vulnerable
nodejs 3.19-main 14.18.1-r0 None possibly vulnerable
nodejs 3.19-main 14.17.6-r0 None possibly vulnerable
nodejs 3.19-main 14.17.5-r0 None possibly vulnerable
nodejs 3.19-main 14.17.4-r0 None possibly vulnerable
nodejs 3.19-main 14.16.1-r0 None possibly vulnerable
nodejs 3.19-main 14.16.0-r0 None possibly vulnerable
nodejs 3.19-main 14.15.5-r0 None possibly vulnerable
nodejs 3.19-main 14.15.4-r0 None possibly vulnerable
nodejs 3.19-main 14.15.1-r0 None possibly vulnerable
nodejs 3.19-main 12.18.4-r0 None possibly vulnerable
nodejs 3.19-main 12.18.0-r0 None possibly vulnerable
nodejs 3.19-main 12.15.0-r0 None possibly vulnerable
nodejs 3.19-main 10.16.3-r0 None possibly vulnerable
nodejs 3.19-main 10.15.3-r0 None possibly vulnerable
nodejs 3.19-main 10.14.0-r0 None possibly vulnerable
nodejs 3.19-main 8.11.4-r0 None possibly vulnerable
nodejs 3.19-main 8.11.3-r0 None possibly vulnerable
nodejs 3.19-main 8.11.0-r0 None possibly vulnerable
nodejs 3.19-main 8.9.3-r0 None possibly vulnerable
nodejs 3.19-main 6.11.5-r0 None possibly vulnerable
nodejs 3.19-main 6.11.1-r0 None possibly vulnerable