{"attribution":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","cve":{"id":"CVE-2026-21717","sourceIdentifier":"support@hackerone.com","published":"2026-03-30T20:16:20.010","lastModified":"2026-08-19T12:54:11.160","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process.\r\n\r\nThe most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table.\r\n\r\nThis vulnerability affects **20.x, 22.x, 24.x, and 25.x**."},{"lang":"es","value":"Un fallo en el mecanismo de hash de cadenas de V8 hace que las cadenas similares a enteros se les aplique hash a su valor numérico, haciendo que las colisiones de hash sean trivialmente predecibles. Al elaborar una solicitud que causa muchas de estas colisiones en la tabla interna de cadenas de V8, un atacante puede degradar significativamente el rendimiento del proceso de Node.js.\n\nEl desencadenante más común es cualquier punto final que llama a `JSON.parse()` en la entrada controlada por el atacante, ya que el análisis JSON internaliza automáticamente cadenas cortas en la tabla hash afectada.\n\nEsta vulnerabilidad afecta a 20.x, 22.x, 24.x y 25.x."}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"nodejs","product":"node","defaultStatus":"unaffected","versions":[{"version":"20.20.1","lessThanOrEqual":"20.20.1","versionType":"semver","status":"affected"},{"version":"22.22.1","lessThanOrEqual":"22.22.1","versionType":"semver","status":"affected"},{"version":"24.14.0","lessThanOrEqual":"24.14.0","versionType":"semver","status":"affected"},{"version":"25.8.1","lessThanOrEqual":"25.8.1","versionType":"semver","status":"affected"},{"version":"4.0","lessThan":"4.*","versionType":"semver","status":"affected"},{"version":"5.0","lessThan":"5.*","versionType":"semver","status":"affected"},{"version":"6.0","lessThan":"6.*","versionType":"semver","status":"affected"},{"version":"7.0","lessThan":"7.*","versionType":"semver","status":"affected"},{"version":"8.0","lessThan":"8.*","versionType":"semver","status":"affected"},{"version":"9.0","lessThan":"9.*","versionType":"semver","status":"affected"},{"version":"10.0","lessThan":"10.*","versionType":"semver","status":"affected"},{"version":"11.0","lessThan":"11.*","versionType":"semver","status":"affected"},{"version":"12.0","lessThan":"12.*","versionType":"semver","status":"affected"},{"version":"13.0","lessThan":"13.*","versionType":"semver","status":"affected"},{"version":"14.0","lessThan":"14.*","versionType":"semver","status":"affected"},{"version":"15.0","lessThan":"15.*","versionType":"semver","status":"affected"},{"version":"16.0","lessThan":"16.*","versionType":"semver","status":"affected"},{"version":"17.0","lessThan":"17.*","versionType":"semver","status":"affected"},{"version":"18.0","lessThan":"18.*","versionType":"semver","status":"affected"},{"version":"19.0","lessThan":"19.*","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":3.6}],"cvssMetricV30":[{"source":"support@hackerone.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-30T19:46:02.350544Z","id":"CVE-2026-21717","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-328"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*","versionEndIncluding":"20.20.1","matchCriteriaId":"42C896A4-ABB4-4DF3-8F8B-320C8E8E6AA3"},{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*","versionStartIncluding":"22.0.0","versionEndIncluding":"22.22.1","matchCriteriaId":"5317F856-6549-4E7C-B6B8-811DE991E7A7"},{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*","versionStartIncluding":"24.0.0","versionEndIncluding":"24.14.0","matchCriteriaId":"DD9D3210-E42B-4584-817D-DAC5F1234234"},{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*","versionStartIncluding":"25.0.0","versionEndIncluding":"25.8.1","matchCriteriaId":"89D03065-041A-4A59-95C4-B2AE7EE36439"}]}]}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/march-2026-security-releases","source":"support@hackerone.com","tags":["Vendor Advisory"]}]}}