CVE-2026-21710

A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**

A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**

Un fallo en el manejo de solicitudes HTTP de Node.js provoca un 'TypeError' no capturado cuando se recibe una solicitud con un encabezado llamado '__proto__' y la aplicación accede a 'req.headersDistinct'. Cuando esto ocurre, 'dest["__proto__"]' se resuelve como 'Object.prototype' en lugar de 'undefined', lo que provoca que se llame a '.push()' en un no-array. Esta excepción se lanza sincrónicamente dentro de un accesor de propiedad y no puede ser interceptada por los oyentes de eventos 'error', lo que significa que no puede ser manejada sin envolver cada acceso a 'req.headersDistinct' en un 'try/catch'. * Esta vulnerabilidad afecta a todos los servidores HTTP de Node.js en 20.x, 22.x, 24.x y v25.x