CVE-2026-21712

Details

A flaw in Node.js URL processing causes an assertion failure in native code when url.format() is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.

Affected Packages

Node.js

Windows 10 (1507)Windows 10 (1607) / Server 2016Windows 10 (1809) / Server 2019Windows 10 (1903)Windows 10 (1909)

References

WEB

https://hackerone.com/reports/3546390

WEB

https://nodejs.org/en/blog/vulnerability/march-2026-security-releases

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-21712