CVE-2026-21712 PUBLISHED

Assigner: hackerone
Reserved: 04.01.2026 Published: 30.03.2026 Updated: 30.03.2026

A flaw in Node.js URL processing causes an assertion failure in native code when url.format() is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.

Metrics

CVSS 3.0

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
CVSS Score: 5.7

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	Low	Integrity Impact	None
User Interaction	Required	Availability Impact	High

CVSS 3.0

Product Status

Vendor	nodejs
Product	node
Versions	Default: unaffected affected from 24.14.0 to 24.14.0 (incl.) affected from 25.8.1 to 25.8.1 (incl.)

References

https://nodejs.org/en/blog/vulnerability/march-2026-security-releases
https://hackerone.com/reports/3546390