Reachable Assertion in Node.js - CVE-2026-21712

Vulnerability identifier: #VU124544

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-21712

CWE-ID: CWE-617

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an assertion error in node_url.cc when processing malformed internationalized domain names via url.format(). A remote attacker can provide a malformed IDN with invalid characters to trigger an assertion failure in native code, crashing the Node.js process.

The flaw is in the native URL formatting logic and does not require elevated privileges.

Node.js
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Web and Scripting Module
nodejs24 (Red Hat package)
npm24
nodejs24-debuginfo
nodejs24
nodejs24-debugsource
nodejs24-devel
nodejs24-docs

Install security update from vendor's website.

Node.js - addressed in versions 24.14.1, 25.8.2
nodejs24 (Red Hat package) - update to 24.14.1-2.el10_1
npm24 - update to 24.14.1-150700.15.8.1
nodejs24-debuginfo - update to 24.14.1-150700.15.8.1
nodejs24 - update to 24.14.1-150700.15.8.1
nodejs24-debugsource - update to 24.14.1-150700.15.8.1
nodejs24-devel - update to 24.14.1-150700.15.8.1
nodejs24-docs - update to 24.14.1-150700.15.8.1

• https://nodejs.org/en/blog/vulnerability/march-2026-security-releases

• Multiple vulnerabilities in Node.js
• SUSE update for nodejs24
• Red Hat Enterprise Linux 9 update for the nodejs:24 module
• Red Hat Enterprise Linux 10 update for nodejs24