#VU124544 Reachable Assertion in Node.js - CVE-2026-21712
Published: March 25, 2026
Vulnerability identifier: #VU124544
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-21712
CWE-ID: CWE-617
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Node.js
Node.js
Software vendor:
Node.js Foundation
Node.js Foundation
Description
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an assertion error in node_url.cc when processing malformed internationalized domain names via url.format(). A remote attacker can provide a malformed IDN with invalid characters to trigger an assertion failure in native code, crashing the Node.js process.
The flaw is in the native URL formatting logic and does not require elevated privileges.
Remediation
Install security update from vendor's website.