Node CVE-2026-21717

CVSS 5.9 reflects moderate severity with notable constraints: attack vector is network (AV:N), but complexity is high (AC:H), indicating the attacker must craft specific, non-trivial payloads to trigger meaningful degradation. EPSS exploitation probability is not provided, limiting real-world risk quantification. No KEV (CISA Known Exploited Vulnerabilities) status or public POC identified, suggesting theoretical or limited-scope practical exploitation to date. The vulnerability requires the target application to expose a JSON.parse() endpoint and process attacker-controlled input without rate-limiting or input size restrictions-a common pattern but not universal. The impact is denial of service (availability), not confidentiality or integrity breach. SSVC context: exploitation is likely feasible for motivated attackers (high AC reflects crafting burden, not technical barrier), automatable via simple JSON generators, and technical impact is limited to availability (single process degradation, not system-wide compromise or data loss). This is a real but moderate-priority issue, particularly for high-availability systems or public-facing APIs with strict SLA requirements. Organizations with request rate-limiting, JSON size caps, or WAF rules filtering malformed JSON are partially mitigated.

An attacker discovers a Node.js application (version 22.x) hosting a public API endpoint that accepts JSON POST requests (e.g., a webhook or data import service). The attacker crafts a malicious JSON payload containing thousands of integer-like string keys (e.g., {'1':'a', '2':'b', '3':'c', ...}) and sends repeated requests to the endpoint. Each request triggers JSON.parse(), which internalizes the integer-like strings and causes hash collisions in V8's string table. After a few dozen requests, the Node.js process CPU usage spikes to 100% due to hash table rehashing overhead, and legitimate requests time out. The attacker can sustain the attack with low bandwidth; complex payload generation is required once, then repeated. No authentication is bypassed (the endpoint is public), and no data is exfiltrated, but the service becomes unavailable to other users.