CVE-2026-21712: Node.js

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.

Affected products

• Node.js Node.js: from 24.0.0, up to and including 24.14.0; from 25.0.0, up to and including 25.8.1

Published 2026-03-30. Last modified 2026-08-19.