]> dgit.raspbian.org Git - nodejs.git/commit
http: use null prototype for headersDistinct/trailersDistinct
authorMatteo Collina <hello@matteocollina.com>
Thu, 19 Feb 2026 14:49:43 +0000 (15:49 +0100)
committerBastien Roucariès <rouca@debian.org>
Sun, 16 Aug 2026 17:34:06 +0000 (19:34 +0200)
commitf31963fe939dfc03c93c3875dcd1f3ac8f6c7da1
tree25b93d3d7852bd82638ea96f008e640c4b213738
parent8aa77069f4b63969b820eb787f1d23950d058999
http: use null prototype for headersDistinct/trailersDistinct

Use { __proto__: null } instead of {} when initializing the
headersDistinct and trailersDistinct destination objects.

A plain {} inherits from Object.prototype, so when a __proto__
header is received, dest["__proto__"] resolves to Object.prototype
(truthy), causing _addHeaderLineDistinct to call .push() on it,
which throws an uncaught TypeError and crashes the process.

Ref: https://hackerone.com/reports/3560402
PR-URL: https://github.com/nodejs-private/node-private/pull/821
Refs: https://hackerone.com/reports/3560402
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2026-21710
origin: https://github.com/nodejs/node/commit/00ad47a28eb2e3dc0ff5610d58c53341acf3cf8d

Gbp-Pq: Name CVE-2026-21710.patch
lib/_http_incoming.js
test/parallel/test-http-headers-distinct-proto.js [new file with mode: 0644]
test/parallel/test-http-multiple-headers.js