Vulnerability DatabaseCVE-2026-21712
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-21712
March 23, 2026
A flaw in Node.js URL processing causes an assertion failure in native code when url.format() is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process. This vulnerability affects 24.x and 25.x.
Affected Packages
https://github.com/nodejs/node.git (GITHUB):
Affected version(s) >=v24.0.0 <v24.14.1
Fix Suggestion:
Update to version v24.14.1
https://github.com/nodejs/node.git (GITHUB):
Affected version(s) >=v24.0.0 <v24.14.1
Fix Suggestion:
Update to version v24.14.1
https://github.com/nodejs/node.git (GITHUB):
Affected version(s) >=v25.0.0 <v25.8.2
Fix Suggestion:
Update to version v25.8.2
https://github.com/nodejs/node.git (GITHUB):
Affected version(s) >=v24.0.0 <v24.14.1
Fix Suggestion:
Update to version v24.14.1
https://github.com/nodejs/node.git (GITHUB):
Affected version(s) >=v25.0.0 <v25.8.2
Fix Suggestion:
Update to version v25.8.2
https://github.com/nodejs/node.git (GITHUB):
Affected version(s) >=v25.0.0 <v25.8.2
Fix Suggestion:
Update to version v25.8.2
Related Resources (1)
https://nodejs.org/en/blog/vulnerability/march-2026-security-releases
Do you need more information?
Contact Us
CVSS v3
Base Score:
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH