Description
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process. The most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.
CVSS breakdown
CVSS 3.0
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected products
- nodejs / node20.20.1 – 20.20.1
- nodejs / node22.22.1 – 22.22.1
- nodejs / node24.14.0 – 24.14.0
- nodejs / node25.8.1 – 25.8.1
- nodejs / node4.0 – 4.*
- nodejs / node5.0 – 5.*
- nodejs / node6.0 – 6.*
- nodejs / node7.0 – 7.*
- nodejs / node8.0 – 8.*
- nodejs / node9.0 – 9.*
- nodejs / node10.0 – 10.*
- nodejs / node11.0 – 11.*
- nodejs / node12.0 – 12.*
- nodejs / node13.0 – 13.*
- nodejs / node14.0 – 14.*
- nodejs / node15.0 – 15.*
- nodejs / node16.0 – 16.*
- nodejs / node17.0 – 17.*
- nodejs / node18.0 – 18.*
- nodejs / node19.0 – 19.*
- nodejs / node.js20.20.1
Updated 5m ago · 8 sources