UnratedFix available
Node.js March 2026 security release addresses CVE-2026-21717
Node.js enabled a seeded hash for array index strings to mitigate HashDoS vulnerability CVE-2026-21717. The fix shipped in the March 2026 security release for the listed Node.js versions.
Announced Group revision 1
Original source ↗nodejs
Primary source · Revision 1
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
In Node.js, this is enabled and shipped to v25, v24, v22, and v20 in the March 2026 security release.
Node.js
In Node.js, this is enabled and shipped to v25, v24, v22, and v20 in the March 2026 security release.
- Affected versions
- Not stated in this extraction
- Fixed versions
- v25
In Node.js, this is enabled and shipped to v25, v24, v22, and v20 in the March 2026 security release.
v24In Node.js, this is enabled and shipped to v25, v24, v22, and v20 in the March 2026 security release.
v22In Node.js, this is enabled and shipped to v25, v24, v22, and v20 in the March 2026 security release.
v20In Node.js, this is enabled and shipped to v25, v24, v22, and v20 in the March 2026 security release.
- Prerequisites
- Not stated in this extraction
- Related CVEs
- CVE-2026-21717
That's the puzzle we tried to solve for addressing CVE-2026-21717 in the March 2026 Node.js security release.
Publisher severity
No explicit severity was extracted.
- Event
- #19336 · Revision 1
- Added to Heist Feed
- Publisher date