{"id":"VND-nodejs-march-2026-security-releases","kind":"vulnerability","aliases":[],"related":["CVE-2024-36137","CVE-2026-21637","CVE-2026-21710","CVE-2026-21711","CVE-2026-21712","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717"],"title":"Node.js: Tuesday, March 24, 2026 Security Releases","description":"Security releases available\nUpdates are now available for the 25.x, 24.x, 22.x, 20.x Node.js release lines for the\nfollowing issues.\nThis security release includes the following dependency updates to address public vulnerabilities:\nundici (6.24.1, 7.24.4) on 22.x, 24.x, 25.x\nIncomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try / catch leading to Remote DoS (CVE-2026-21637) - (High)\nA flaw in Node.js TLS error handling leaves SNICallback invocations unprotected against synchronous exceptions, while the equivalent ALPN and PSK callbacks were already addressed in CVE-2026-21637. This represents an incomplete fix of that prior vulnerability.\nWhen an SNICallback throws synchronously on unexpected input the exception bypasses TLS error handlers and propagates as an uncaught exception, crashing the Node.js process.\nThis vulnerability affects all Node.js versions that received the CVE-2026-21637 fix, including 20.x, 22.x, 24.x, and 25.x , on any TLS server where SNICallback may throw on unexpected servername input.\nThank you, to mbarbs for reporting this vulnerability and thank you mcollina for fixing it.\nDenial of Service via __proto__ header name in req.headersDistinct (Uncaught TypeError crashes Node.js process) (CVE-2026-21710) - (High)\nA flaw in Node.js HTTP request handling causes an uncaught TypeError when a request is received with a header named __proto__ and the application accesses req.headersDistinct .\nWhen this occurs, dest[&quot;__proto__&quot;] resolves to Object.prototype rather than undefined , causing .push() to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by error event listeners, meaning it cannot be handled without wrapping every req.headersDistinct access in a try/catch .\nThis vulnerability affects all Node.js HTTP servers on 20.x, 22.x, 24.x, and v25.x\nThank you, to yushengchen for reporting this vulnerability and thank you mcollina for fixing it.\nNode.js Permission Model bypass: UDS server bind/listen works without --allow-net (CVE-2026-21711) - (Medium)\nA flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.\nAs a result, code running under --permission without --allow-net can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.\nThis vulnerability affects Node.js 25.x processes using the Permission Model where --allow-net is intentionally omitted to restrict network access. Note that --allow-net is currently an experimental feature.\nThank you, to xavlimsg for reporting this vulnerability and thank you RafaelGSS for fixing it.\nAssertion error in node_url.cc via malformed URL format leads to Node.js crash (CVE-2026-21712) - (Medium)\nA flaw in Node.js URL processing causes an assertion failure in native code when url.format() is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.\nThis vulnerability affects 24.x and 25.x .\nThank you, to wooffie for reporting this vulnerability and thank you RafaelGSS for fixing it.\nTiming side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery (CVE-2026-21713) - (Medium)\nA flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values.\nNode.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision.\nThis vulnerability affects 20.x, 22.x, 24.x, and 25.x .\nThank you, to x_probe for reporting this vulnerability and thank you panva for fixing it.\nMemory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion (CVE-2026-21714) - (Medium)\nA memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.\nThis vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.\nThank you, to galbarnahum for reporting this vulnerability and thank you RafaelGSS for fixing it.\nHashDoS in V8 (CVE-2026-21717) - (Medium)\nA flaw in V8&#x27;s string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8&#x27;s internal string table, an attacker can significantly degrade performance of the Node.js process.\nThe most common trigger is any endpoint that calls JSON.parse() on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table.\nThis vulnerability affects 20.x, 22.x, 24.x, and 25.x .\nThank you, to sharp_edged for reporting this vulnerability and thank you joyeecheung for fixing it.\nPermission Model Bypass in realpathSync.native Allows File Existence Disclosure (CVE-2026-21715) - (Low)\nA flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync.native() without the required read permission checks, while all comparable filesystem functions correctly enforce them.\nAs a result, code running under --permission with restricted --allow-fs-read can still use fs.realpathSync.native() to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.\nThis vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where --allow-fs-read is intentionally restricted.\nThank you, to stif for reporting this vulnerability and thank you RafaelGSS for fixing it.\nCVE-2024-36137 Patch Bypass - FileHandle.chmod/chown (CVE-2026-21716) - (Low)\nAn incomplete fix for CVE-2024-36137 leaves FileHandle.chmod() and FileHandle.chown() in the promises API without the required permission checks, while their callback-based equivalents ( fs.fchmod() , fs.fchown() ) were correctly patched.\nAs a result, code running under --permission with restricted --allow-fs-write can still use promise-based FileHandle methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions.\nThis vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where --allow-fs-write is intentionally restricted.\nThank you, to wooseokdotkim for reporting this vulnerability and thank you RafaelGSS for fixing it.\nDownloads and release details\nNode.js v20.20.2\nNode.js v22.22.2\nNode.js v24.14.1\nNode.js v25.8.2\nSummary\nThe Node.js project will release new versions of the 25.x, 24.x, 22.x, 20.x\nreleases lines on or shortly after, Tuesday, March 24, 2026 in order to address:\n2 high severity issues.\n5 medium severity issues.\n2 low severity issues.\nImpact\nThe 25.x release line of Node.js is vulnerable to 2 high severity issues, 5 medium severity issues, 2 low severity issues.\nThe 24.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues.\nThe 22.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues.\nThe 20.x release line of Node.js is vulnerable to 2 high severity issues, 4 medium severity issues, 2 low severity issues.\nIt&#x27;s important to note that End-of-Life versions are always affected when a security release occurs.\nTo ensure your system&#x27;s security, please use an up-to-date version as outlined in our\nRelease Schedule .\nRelease timing\nReleases will be available on, or shortly after, Tuesday, March 24, 2026.\nContact and future updates\nThe current Node.js security policy can be found at https://nodejs.org/en/security/ .\nPlease follow the process outlined in https://github.com/nodejs/node/blob/master/SECURITY.md if you wish to report a vulnerability in Node.js.\nSubscribe to the low-volume announcement-only nodejs-sec mailing list at https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on security vulnerabilities and security-related releases of Node.js and the projects maintained in the nodejs GitHub organization. Previous Developing a minimally HashDoS resistant, yet quickly reversible integer hash for V8 Next OpenSSL Security Advisory Assessment, January 2026","summary":"Node.js 20.x, 22.x, 24.x and 25.x release lines received fixes for two high, five medium and two low severity issues, including crashes via TLS SNICallback, HTTP header handling and HTTP/2 WINDOW_UPDATE, plus Permission Model bypasses for Unix socket binding, realpathSync.native and FileHandle.chmod/chown. An attacker can crash a server process or, for the permission flaws, reach files, sockets or permission-restricted operations that the Permission Model was meant to block.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"node","fixed":["20.20.2"],"affected":">= 20.0.0, < 20.20.2","ecosystem":"node"},{"name":"node","fixed":["22.22.2"],"affected":">= 22.0.0, < 22.22.2","ecosystem":"node"},{"name":"node","fixed":["24.14.1"],"affected":">= 24.0.0, < 24.14.1","ecosystem":"node"},{"name":"node","fixed":["25.8.2"],"affected":">= 25.0.0, < 25.8.2","ecosystem":"node"}],"ecosystems":["node"],"tags":["http-servers","http2","node","node.js","runtime","self-hosted","tls"],"not_affected_if":["no-permission-model","static-export"],"how_to_check":"- Run `node --version` and compare against the fixed versions: `20.20.2`, `22.22.2`, `24.14.1`, `25.8.2`.\n- Check whether code runs under `--permission` with `--allow-fs-read`, `--allow-fs-write` or without `--allow-net` (the Permission Model is experimental, per the sources).\n- Check whether TLS servers use SNICallback, or HTTP code reads `req.headersDistinct`.","fix":"- Upgrade Node.js to `20.20.2`, `22.22.2`, `24.14.1` or `25.8.2` on the matching release line.\n- Upgrade undici to `6.24.1` or `7.24.4` where applications pin it, per the sources for 22.x, 24.x and 25.x.\n- Note: the sources say End-of-Life versions remain affected and give no separate fixed version for them, so move off EOL lines.","status":"open","published_at":"2026-03-24T03:00:00+00:00","first_seen_at":"2026-10-23T19:13:00+00:00","triaged_at":"2026-10-25T05:37:28+00:00","updated_at":"2026-10-25T05:37:28+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T05:37:28Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Node.js to `20.20.2`, `22.22.2`, `24.14.1` or `25.8.2` on the matching release line.\n- Upgrade undici to `6.24.1` or `7.24.4` where applications pin it, per the sources for 22.x, 24.x and 25.x.\n- Note: the sources say End-of-Life versions remain affected and give no separate fixed version for them, so move off EOL lines.","reach":"internet","title":"Node.js: March 2026 security releases fix DoS, permission bypasses and HMAC timing leak","impact":"high","summary":"Node.js 20.x, 22.x, 24.x and 25.x release lines received fixes for two high, five medium and two low severity issues, including crashes via TLS SNICallback, HTTP header handling and HTTP/2 WINDOW_UPDATE, plus Permission Model bypasses for Unix socket binding, realpathSync.native and FileHandle.chmod/chown. An attacker can crash a server process or, for the permission flaws, reach files, sockets or permission-restricted operations that the Permission Model was meant to block.","category":"runtime","nicknames":[],"who_cares":["node.js","self-hosted","http-servers","tls","http2"],"confidence":0.7,"needs_auth":"no","worst_case":"Remote clients crash the Node.js process; permission-restricted code reads or changes files","analyst_note":"Check the Node.js blog URL in the sources for per-issue affected-version detail and any EOL line fix guidance; sources give a combined version range per issue only loosely.","how_to_check":"- Run `node --version` and compare against the fixed versions: `20.20.2`, `22.22.2`, `24.14.1`, `25.8.2`.\n- Check whether code runs under `--permission` with `--allow-fs-read`, `--allow-fs-write` or without `--allow-net` (the Permission Model is experimental, per the sources).\n- Check whether TLS servers use SNICallback, or HTTP code reads `req.headersDistinct`.","needs_analyst":true,"not_affected_if":["no-permission-model","static-export"],"who_is_affected":"Any application running on the listed Node.js release lines is affected by at least one of these issues, and the TLS, HTTP and HTTP/2 crashes apply to servers that accept network traffic. The Permission Model bypasses only matter for processes that use --permission and rely on it to restrict file, socket or network access. Teams that run no Node.js servers and do not use the Permission Model can deprioritise the permission items.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.001114,"input_tokens":6585,"output_tokens":911,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':158C,171C,200C,245C,300C,424C,549C,623C '-21637':159C,172C,201C,246C '-21710':301C '-21711':425C '-21712':550C '-21713':624C '/chown.':79B '20':32B,123C,249C,388C,708C '2026':5A,12A '22':34B,121C,148C,251C,390C,710C '24':4A,36B,119C,150C,253C,392C,586C,712C '25':39B,117C,152C,256C,493C,589C,715C '6.24.1':145C '7.24.4':146C 'access':327C,376C,510C 'address':141C,197C 'affect':237C,382C,491C,585C,707C 'allow':421C,464C,473C,502C,514C 'allow-net':420C,463C,501C,513C 'alpn':191C 'alreadi':196C,682C 'applic':326C 'array':349C 'assert':536C,560C 'attack':81B 'avail':110C,114C 'behavior':669C 'bind':74B 'bind/listen':417C 'block':107B 'boundari':488C 'bypass':70B,221C,414C 'byte':655C 'call':344C,568C 'callback':194C 'cannot':360C,369C 'catch':165C 'caus':310C,340C,558C 'certain':657C 'channel':609C 'charact':578C 'check':446C 'code':458C,564C 'codebas':693C 'communic':474C 'compar':449C 'comparison':638C,687C 'constant':636C 'contain':576C 'correct':452C 'could':670C 'crash':56B,83B,231C,296C,547C,579C 'creat':467C 'crypto_hmac.cc':616C 'current':517C 'cve':157C,170C,199C,244C,299C,423C,548C,622C 'decis':704C 'denial':285C 'depend':138C 'design':703C 'dest':332C 'domain':437C,573C 'dos':169C 'elsewher':690C 'endpoint':472C 'enforc':434C,453C 'equival':190C 'error':179C,223C,364C,537C 'event':365C 'everi':374C 'except':187C,220C,230C,351C 'experiment':519C 'exploit':672C 'expos':469C 'failur':561C 'featur':520C 'file':93B 'filehandle.chmod':78B 'filehandle.chmod/chown.':77B 'five':48B 'fix':44B,155C,206C,247C,283C,409C,534C,604C 'flaw':91B,175C,304C,428C,553C,627C 'follow':130C,137C 'forgeri':621C 'format':543C 'getter':358C 'handl':62B,180C,309C,371C 'handler':224C 'header':61B,290C,321C 'high':47B,173C,302C,662C 'high-resolut':661C 'hmac':611C,630C,679C 'host':29B,481C 'http':21B,60B,307C,385C 'http-server':20B 'http/2':64B 'http2':23B 'idn':575C 'includ':55B,135C,248C 'incomplet':154C,205C 'indic':694C 'infer':678C 'inform':648C 'input':218C,269C 'insid':355C 'intend':485C 'intent':505C,702C 'intercept':362C 'internation':572C 'invalid':577C 'invoc':183C 'ipc':471C 'issu':54B,131C 'lack':163C 'lead':166C,544C,617C 'leak':646C 'leav':181C,435C 'line':42B,127C 'listen':366C 'loadsni':160C 'local':470C 'low':52B 'mac':620C 'malform':541C,571C 'march':3A,11A 'match':654C 'may':264C 'mbarb':273C 'mcollina':281C,407C 'mean':367C 'meant':105B 'measur':665C 'medium':49B,426C,551C,625C 'memcmp':614C 'model':69B,103B,413C,432C,499C,659C 'name':291C,322C,574C 'nativ':563C 'net':422C,465C,503C,515C 'network':433C,450C,486C,509C 'node':16A,17A,18A,19A,24B 'node.js':1A,25B,31B,125C,177C,233C,239C,297C,306C,384C,411C,430C,492C,546C,555C,581C,629C,681C 'node_url.cc':539C 'nodejs':10A 'non':348C,635C 'non-array':347C 'non-constant-tim':634C 'note':511C 'number':652C 'object.prototype':336C 'occur':331C 'omit':506C 'oper':99B,441C 'oracl':676C 'outsid':482C 'oversight':698C 'path':451C 'permiss':68B,90B,97B,102B,412C,431C,445C,461C,498C 'permission-restrict':96B 'plus':67B 'possibl':667C 'potenti':619C,645C 'primit':688C 'prior':209C 'process':86B,234C,298C,477C,495C,557C,582C 'propag':226C 'properti':357C 'proport':649C 'proto':289C,323C,333C 'provid':643C,683C 'psk':193C 'public':142C 'push':341C 'rafaelgss':532C,602C 'rather':337C,699C 'reach':92B 'realpathsync.native':75B 'receiv':43B,242C,318C 'releas':7A,41B,109C,126C,134C 'releases':15A 'remot':168C 'report':275C,401C,526C,596C 'repres':203C 'req.headersdistinct':293C,328C,375C 'request':308C,316C 'requir':444C 'resolut':663C 'resolv':334C 'restrict':98B,487C,508C 'result':457C 'run':459C 'runtim':26B 'safe':686C 'secur':6A,108C,133C 'security':14A 'security-releases':13A 'self':28B 'self-host':27B 'server':22B,85B,261C,386C,416C,440C 'servernam':268C 'servic':287C 'sever':53B 'side':608C 'side-channel':607C 'signatur':644C 'snicallback':59B,182C,213C,263C 'socket':73B,94B,438C 'synchron':186C,215C,354C 'tha':717C 'thank':270C,279C,396C,405C,521C,530C,591C,600C 'threat':658C 'throw':214C,265C 'thrown':353C 'time':606C,637C,647C,664C,675C,685C 'timing-saf':684C 'tls':30B,58B,178C,222C,260C 'tls_wrap.js':162C 'tri':164C 'try/catch':379C 'tuesday':2A 'two':46B,51B 'typeerror':295C,313C 'ud':415C,439C 'uncaught':229C,294C,312C 'undefin':339C 'undici':144C 'unexpect':217C,267C 'unix':72B,436C 'unprotect':184C 'updat':66B,111C,139C 'url':542C,556C 'url.format':566C 'use':496C,632C,689C 'user':642C 'user-provid':641C 'v25.x':395C 'valid':640C 'valu':680C 'verif':612C,631C 'version':240C 'via':57B,288C,540C,613C 'vnd':9A 'vnd-nodejs-march':8A 'vulner':143C,210C,236C,277C,381C,403C,490C,528C,584C,598C,706C 'window':65B 'without':372C,419C,442C,462C 'wooffi':594C 'work':418C 'wrap':373C 'x':33B,35B,37B,40B,118C,120C,122C,124C,149C,151C,153C,250C,252C,254C,257C,389C,391C,393C,494C,587C,590C,709C,711C,713C,716C 'xavlimsg':524C 'yushengchen':399C","nicknames":[],"mitigations":[],"who_affected":"Any application running on the listed Node.js release lines is affected by at least one of these issues, and the TLS, HTTP and HTTP/2 crashes apply to servers that accept network traffic. The Permission Model bypasses only matter for processes that use --permission and rely on it to restrict file, socket or network access. Teams that run no Node.js servers and do not use the Permission Model can deprioritise the permission items.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-03-24T03:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nodejs","external_id":"march-2026-security-releases","url":"https://nodejs.org/en/blog/vulnerability/march-2026-security-releases","severity":"high","published_at":"2026-03-24T03:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:13:00+00:00","fetched_at":"2026-10-25T11:22:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}