TypeError Vulnerability in Node.js HTTP Request Handling

CVE-2026-21710

What is CVE-2026-21710?

A flaw in Node.js HTTP request handling occurs when a request contains a header named 'proto'. This causes a TypeError when accessing req.headersDistinct, as it mistakenly resolves dest['__proto__'] to Object.prototype instead of undefined. Consequently, this results in a call to .push() on a non-array, which throws an exception that cannot be intercepted by error event listeners. Therefore, developers need to wrap each access of req.headersDistinct in a try/catch block to handle this vulnerability effectively.

References