CVE-2026-21712
Published:March 30, 2026
Updated:April 23, 2026
A flaw in Node.js URL processing causes an assertion failure in native code when "url.format()" is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.
Affected Packages
https://github.com/nodejs/node.git (GITHUB):
Affected version(s) >=v24.0.0 <v24.14.1Fix Suggestion:
Update to version v24.14.1https://github.com/nodejs/node.git (GITHUB):
Affected version(s) >=v25.0.0 <v25.8.2Fix Suggestion:
Update to version v25.8.2Related Resources (2)
Do you need more information?
Contact UsCVSS v3
Base Score:
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
EPSS
Base Score:
0.01
