String Hashing Flaw in Node.js by OpenJS Foundation

CVE-2026-21717

What is CVE-2026-21717?

A flaw in Node.js's V8 engine's string hashing mechanism allows integer-like strings to be hashed as their numeric values, resulting in easily predictable hash collisions. Attackers can exploit this vulnerability by crafting specific requests that generate multiple collisions within V8's string table, leading to significant performance degradation of Node.js processes. Common attack vectors involve endpoints utilizing JSON parsing on untrusted input, as this process can inadvertently trigger the flawed hashing mechanism.

References