A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
- CVSS 3.0 Base Score: 5.7
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejsUpgrade v8-13.6-develUpgrade nodejs-docsUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejs-full-i18n | Apr 16, 2026 | Apr 9, 2026 |
| Alpine Linux | — | Upgrade nodejs | Mar 31, 2026 | Mar 30, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs24Upgrade nodejs24-npmUpgrade nodejs24-libsUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-develUpgrade nodejs24-full-i18nUpgrade v8-13.6-develUpgrade nodejs24-debugsourceUpgrade nodejs24-debuginfoUpgrade nodejs24-docs | Apr 14, 2026 | Mar 30, 2026 |
| Oracle_linux | — | Upgrade v8-13.6-develUpgrade nodejs24-develUpgrade nodejs24-docsUpgrade nodejsUpgrade nodejs-nodemonUpgrade nodejs24-npmUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade npmUpgrade nodejs-libsUpgrade nodejs24-full-i18nUpgrade nodejs24Upgrade nodejs-packagingUpgrade nodejs24-libsUpgrade nodejs-packaging-bundler | Apr 22, 2026 | Mar 30, 2026 |
| Redhat_linux | — | Upgrade nodejs24-develUpgrade nodejs24-full-i18nNo solution existsUpgrade nodejs-packaging-bundlerUpgrade nodejs-docsUpgrade nodejs24-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejs24-debuginfoUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade nodejs24-docsUpgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade nodejs24-libsUpgrade nodejs24-npmUpgrade v8-13.6-develUpgrade nodejs24Upgrade nodejs24-libs-debuginfoUpgrade nodejsUpgrade npmUpgrade nodejs-develUpgrade nodejs-libs | Apr 13, 2026 | Mar 30, 2026 |
| Rocky_linux | — | Upgrade nodejs24-debuginfoUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-full-i18nUpgrade nodejs-libs-debuginfoUpgrade nodejs24-debugsourceUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs24-develUpgrade v8-13.6-develUpgrade nodejs-develUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs24Upgrade nodejs24-libs | Apr 13, 2026 | Apr 10, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub