http: use null prototype for headersDistinct/trailersDistinct
authorMatteo Collina <hello@matteocollina.com>
Thu, 19 Feb 2026 14:49:43 +0000 (15:49 +0100)
committerBastien Roucariès <rouca@debian.org>
Mon, 6 Apr 2026 14:18:52 +0000 (16:18 +0200)
commit08d3476090a2af01efc9cfbcdefe051aa51f92aa
treef348c3f353e8a723b5dba01933bdcba5a33dfaea
parente8d8a25f11655cb2a38185be841fc09be569ca75
http: use null prototype for headersDistinct/trailersDistinct

Use { __proto__: null } instead of {} when initializing the
headersDistinct and trailersDistinct destination objects.

A plain {} inherits from Object.prototype, so when a __proto__
header is received, dest["__proto__"] resolves to Object.prototype
(truthy), causing _addHeaderLineDistinct to call .push() on it,
which throws an uncaught TypeError and crashes the process.

Ref: https://hackerone.com/reports/3560402
PR-URL: https://github.com/nodejs-private/node-private/pull/821
Refs: https://hackerone.com/reports/3560402
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2026-21710
origin: https://github.com/nodejs/node/commit/00ad47a28eb2e3dc0ff5610d58c53341acf3cf8d

Gbp-Pq: Name CVE-2026-21710.patch
lib/_http_incoming.js
test/parallel/test-http-headers-distinct-proto.js [new file with mode: 0644]
test/parallel/test-http-multiple-headers.js