CVE-2026-21712

Published: Mar 30, 2026Modified: Aug 19, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.

Affected (2)

Products: Nodejs: Node.js

Nodejs

1 product

Node.js

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Nodejs Node.js	From 24.0.0 to 24.14.0
Nodejs Node.js	From 25.0.0 to 25.8.1

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

https://hackerone.com/reports/3546390

Source: support@hackerone.com

Issue TrackingThird Party Advisory

https://nodejs.org/en/blog/vulnerability/march-2026-security-releases

Source: support@hackerone.com

Vendor Advisory

Timeline

No history available yet.