CVE-2026-21710

A Node.js HTTP server crashes with an unhandled error when receiving a request with a header named `__proto__` if the application reads `req.headersDistinct`. This denial-of-service flaw cannot be caught by normal error handlers, forcing developers to add extra protection around header access.

The vulnerability exploits prototype pollution via HTTP header injection; when `__proto__` header is present and `req.headersDistinct` is accessed, the property getter resolves `dest["__proto__"]` to `Object.prototype` instead of undefined, causing a synchronous TypeError when `.push()` is called on the prototype object. This exception cannot be intercepted by error event listeners, enabling unauthenticated DoS against Node.js HTTP servers on versions 20.x, 22.x, 24.x, and 25.x.