CVE-2026-21712

Vulnerability

Overview

A flaw in Node.js URL processing causes an assertion failure in native code when url.format() is called with a malformed internationalized domain name (IDN) containing invalid characters. This results in a crash of the Node.js process. The issue is present in Node.js versions 20.x, 22.x, 24.x, and 25.x [1].

Exploitation

An attacker can trigger this vulnerability by providing a specially crafted URL with an invalid IDN to an application that uses url.format(). No authentication is required if the application processes user-supplied URLs. The attack can be performed remotely over the network, leading to a denial of service (DoS) condition [1].

Impact

Successful exploitation causes the Node.js process to crash due to an assertion failure. This results in a denial of service, potentially affecting the availability of the application or service [1].

Mitigation

The Node.js project has released security updates for the affected release lines (20.x, 22.x, 24.x, 25.x) to address this vulnerability. Users are advised to upgrade to the latest patched versions as specified in the March 2026 security release [1].