Fluid Attacks Database

Description

A flaw in Node.js URL processing causes an assertion failure in native code when url.format() is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
alpine v3.23	nodejs	>=0 <24.14.1-r0	24.14.1-r0
rpm rhel8	nodejs	-	-
rpm rhel9	nodejs	-	-
rpm rhel10	nodejs22	-	-
rpm rhel10	nodejs24	<1:24.14.1-2.el10_1	1:24.14.1-2.el10_1
alpine v3.24	nodejs	>=0 <24.14.1-r0	24.14.1-r0
npm	node	>=24.0.0 <=24.14.0 \|\| >=25.0.0 <=25.8.1	25.7.0, 20.20.2

Aliases

1. CVE-2026-217122. NVD-2026-217123. OSV-ALPINE-2026-217124. OSV-2026-217125. GCVE-2026-217126. SECURITY-CVE-2026-217127. https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21712.json

References

1. https://hackerone.com/reports/35463902. https://nodejs.org/en/blog/vulnerability/march-2026-security-releases

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.