Reachable Assertion in Node.js - CVE-2026-21712
Published: March 25, 2026
Vulnerability identifier: #VU124544
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-21712
CWE-ID: CWE-617
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Node.js Foundation
Affected software:
Node.js
Node.js
Detailed vulnerability description
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an assertion error in node_url.cc when processing malformed internationalized domain names via url.format(). A remote attacker can provide a malformed IDN with invalid characters to trigger an assertion failure in native code, crashing the Node.js process.
The flaw is in the native URL formatting logic and does not require elevated privileges.
How to mitigate CVE-2026-21712
Install security update from vendor's website.