CVE-2026-21717: Node.js V8 Hash Collision DoS Vulnerability

CVE-2026-21717 Overview

A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process.

The most common trigger is any endpoint that calls JSON.parse() on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table.

Critical Impact

Remote attackers can cause significant performance degradation in Node.js applications by exploiting predictable hash collisions in V8's string internalization, leading to denial of service conditions.

Affected Products

• Node.js 20.x
• Node.js 22.x
• Node.js 24.x
• Node.js 25.x

Discovery Timeline

• 2026-03-30 - CVE CVE-2026-21717 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-21717

Vulnerability Analysis

This algorithmic complexity attack targets V8's string hashing implementation, which is the JavaScript engine underlying Node.js. The vulnerability stems from how V8 handles string internalization—specifically, when strings that resemble integers are processed, they are hashed to their numeric value rather than using a more randomized hashing approach.

The attack surface is particularly broad because JSON.parse() automatically internalizes short strings into V8's internal string table. This means any Node.js application that parses JSON from untrusted sources—which includes the vast majority of web services—is potentially vulnerable.

When an attacker crafts input containing many strings that hash to the same bucket, the hash table degrades from O(1) to O(n) lookup performance. With sufficient collision strings, this can cause the Node.js event loop to become unresponsive, effectively creating a denial of service condition.

Root Cause

The root cause lies in V8's optimization for integer-like strings in its string hashing algorithm. When V8 encounters strings that represent integers (such as "123" or "456"), it hashes these strings to their numeric value for performance optimization in common JavaScript patterns. However, this deterministic behavior makes the hash values completely predictable, allowing attackers to construct sets of strings that will all collide in the same hash bucket.

Attack Vector

This vulnerability is exploitable over the network without any authentication or user interaction. An attacker can send specially crafted HTTP requests containing JSON payloads with numerous integer-like strings designed to collide in V8's string table. The attack complexity is considered high because the attacker must understand the hashing algorithm and craft collision-inducing payloads.

The most straightforward exploitation path involves:

1. Identifying a target endpoint that processes JSON input
2. Constructing a payload containing many strings that will hash to the same value
3. Sending repeated requests to exhaust CPU resources during hash table operations

The vulnerability mechanism exploits how V8's string table internalizes short strings during JSON parsing. When JSON.parse() encounters string values, it checks if they should be internalized into the string table for memory efficiency. Integer-like strings receive special treatment during hashing, making their hash values predictable. An attacker can construct payloads where all string keys or values hash to identical buckets, causing hash table operations to degrade from constant to linear time complexity. For detailed technical information, see the Node.js March 2026 Security Update.

Detection Methods for CVE-2026-21717

Indicators of Compromise

• Unusual CPU spikes in Node.js processes without corresponding increase in legitimate traffic
• Slow response times or timeouts on JSON-processing endpoints
• HTTP requests with abnormally large JSON payloads containing many short string keys
• Event loop lag metrics showing significant degradation

Detection Strategies

• Monitor Node.js event loop lag metrics for unexpected spikes indicating hash collision attacks
• Implement request rate limiting on endpoints that process JSON input
• Use application performance monitoring (APM) tools to detect CPU exhaustion patterns
• Analyze incoming JSON payloads for suspicious patterns of integer-like string keys

Monitoring Recommendations

• Set up alerts for Node.js process CPU utilization exceeding normal baselines
• Monitor HTTP request payload sizes and reject abnormally large JSON bodies
• Track response time percentiles (p95, p99) to detect performance degradation early
• Implement logging for JSON parsing duration to identify slow parsing operations

How to Mitigate CVE-2026-21717

Immediate Actions Required

• Update affected Node.js installations to the latest patched versions
• Implement request body size limits to reduce the potential impact of collision attacks
• Add rate limiting on endpoints that process user-supplied JSON
• Consider implementing request timeouts to prevent long-running parsing operations

Patch Information

Node.js has released security updates addressing this vulnerability across all affected major versions (20.x, 22.x, 24.x, and 25.x). Organizations should upgrade to the latest security releases as documented in the Node.js March 2026 Security Update.

Workarounds

• Implement strict payload size limits for JSON request bodies (e.g., maximum 1MB)
• Use a Web Application Firewall (WAF) to filter requests with suspicious JSON patterns
• Deploy request timeout mechanisms to terminate slow JSON parsing operations
• Consider using a reverse proxy to implement rate limiting before requests reach Node.js

# Configuration example
# Example nginx configuration to limit request body size
client_max_body_size 1m;

# Rate limiting configuration
limit_req_zone $binary_remote_addr zone=json_limit:10m rate=10r/s;

location /api/ {
    limit_req zone=json_limit burst=20 nodelay;
    proxy_pass http://nodejs_backend;
}