Node.js Denial-of-Service Vulnerability via `__proto__` Header in HTTP Request Handling

A denial-of-service vulnerability has been identified in Node.js versions 20.x, 22.x, 24.x, and 25.x. The issue arises in the HTTP request handling when a request includes a header named `__proto__`. If the application accesses `req.headersDistinct`, the `__proto__` header resolves to `Object.prototype` instead of `undefined`. This misalignment causes a `TypeError` by attempting to call `.push()` on a non-array. The error is thrown synchronously within a property getter, bypassing `error` event listeners and creating a crash. To manage this vulnerability, every access to `req.headersDistinct` must be wrapped in a `try/catch` block.

Impact

Exploitation of this vulnerability leads to an uncaught `TypeError`, causing the Node.js process to crash.

Remediation

Users can update to Node.js versions 20.20.2, 22.22.2, 24.14.1, or 25.8.2 to address this vulnerability.