Description
A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected products
- nodejs / node20.20.1 – 20.20.1
- nodejs / node22.22.1 – 22.22.1
- nodejs / node24.14.0 – 24.14.0
- nodejs / node25.8.1 – 25.8.1
- nodejs / node4.0 – 4.*
- nodejs / node5.0 – 5.*
- nodejs / node6.0 – 6.*
- nodejs / node7.0 – 7.*
- nodejs / node8.0 – 8.*
- nodejs / node9.0 – 9.*
- nodejs / node10.0 – 10.*
- nodejs / node11.0 – 11.*
- nodejs / node12.0 – 12.*
- nodejs / node13.0 – 13.*
- nodejs / node14.0 – 14.*
- nodejs / node15.0 – 15.*
- nodejs / node16.0 – 16.*
- nodejs / node17.0 – 17.*
- nodejs / node18.0 – 18.*
- nodejs / node19.0 – 19.*
- nodejs / node.js20.20.1
- RedHat / enterprise_linux8.0 – 8.0
- RedHat / enterprise_linux9.0 – 9.0
- RedHat / enterprise_linux10.0 – 10.0
- RedHat / enterprise_linux_eus9.4 – 9.4
- RedHat / enterprise_linux_eus9.6 – 9.6
- RedHat / enterprise_linux_eus10.0 – 10.0
Updated 5m ago · 8 sources