CVE-2026-21712

NONE EPSS 24.3%
Published Mar 30, 20263mo ago · Modified Jun 17, 20262w ago
Find Similar
Published Mar 30, 2026 3mo ago
Last Modified Jun 17, 2026 2w ago

Description

A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.

Threat Intelligence

EPSS Exploit Probability
24.3% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-20 Improper Input Validation Validation

References 2

  • hackerone.com https://hackerone.com/reports/3546390
  • nodejs.org https://nodejs.org/en/blog/vulnerability/march-2026-security-releases

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.