An unauthenticated remote denial of service vulnerability in Node.js allows attackers to crash HTTP server instances by sending requests with specifically crafted headers.

The vulnerability exists in the HTTP request handling logic, where the inclusion of a proto header triggers an uncaught TypeError when the application accesses req.headersDistinct. Because this exception occurs synchronously inside a property getter, it cannot be intercepted by standard error event listeners, resulting in an immediate process crash for unauthenticated attackers.

The vulnerability carries a CVSS score of 7.5, reflecting its high availability impact. Successful exploitation causes immediate service disruption, which can lead to significant downtime for critical web applications and services. Because the attack is unauthenticated and automatable, it poses a high risk to any public-facing Node.js infrastructure.

Immediate Action: Update Node.js to the latest patched version as specified in the official March 2026 security release announcement.

Proactive Monitoring: Monitor server logs and process health dashboards for frequent, unexplained process restarts or recurring uncaught exception errors in HTTP request handling modules.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an ingress controller to filter and block incoming HTTP requests that contain proto in the header field before they reach the application layer.

Public Exploit Available: Unknown

Given the ease of exploitation and the potential for widespread service disruption, organizations should prioritize patching their Node.js environments immediately. Verify that your application dependencies are updated to the versions provided in the vendor security advisory to ensure the fix is correctly implemented.