CVE-2026-21712

Name of the Vulnerable Software and Affected Versions Node.js (affected versions not specified)

Description A flaw in URL processing within the url module causes an assertion failure in native code. This occurs when the url.format() function is called with a malformed internationalized domain name (IDN) containing invalid characters, which leads to a crash of the Node.js process and can be exploited by a remote attacker to cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.