CVE-2026-21712
Medium · 6.5CVSS
6.5
EPSS
0.3%
Published
Mar 30, 2026
CISA due date
—
The record
A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | nodejs24 | 0 | 24.14.1-160000.1.1 |
| openSUSE:Tumbleweed | nodejs24 | 0 | 24.14.1-1.1 |
| openSUSE:Tumbleweed | nodejs26 | 0 | 26.3.1-1.1 |
Related vulnerabilities
- CVE-2026-21717 A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their… Also affects nodejs24
- CVE-2026-21716 An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()`… Also affects nodejs24
- CVE-2026-21714 A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames… Also affects nodejs24
- CVE-2026-21715 A flaw in Node.js Permission Model filesystem enforcement leaves… Also affects nodejs24
- CVE-2026-21713 A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating… Also affects nodejs24
- CVE-2026-21710 A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is… Also affects nodejs24
- CVE-2025-59464 A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate… Also affects nodejs24
- CVE-2026-48935 A flaw in Node.js Permission API can cause a file metadata to be modified even on a path… Also affects nodejs24