{
  "fix": "DEBIAN-CVE-2026-21717",
  "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-21717",
  "summary": "DEBIAN-CVE-2026-21717, released March 30, 2026, fixes 1 CVE in nodejs. None of them is reported as exploited. Patch Radar priority: High.",
  "platform": "linux",
  "type": "advisory",
  "title": "nodejs security update",
  "released": "2026-03-30T20:16:20Z",
  "priority": "High",
  "priorityTier": 3,
  "priorityReason": "Closes CVE-2026-21717, high severity",
  "supported": true,
  "cveCount": 1,
  "exploitedCveCount": 0,
  "kevCveCount": 0,
  "ransomwareCveCount": 0,
  "maxEpss": 0.00273,
  "maxCvss": 7.5,
  "vendorAdvisory": "https://security-tracker.debian.org/tracker/CVE-2026-21717",
  "appliesTo": [
    {
      "product": "nodejs",
      "productUrl": "https://patchblox.com/security/product/linux/nodejs",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "20.19.2\u002Bdfsg-1\u002Bdeb13u2",
      "supported": true
    },
    {
      "product": "nodejs",
      "productUrl": "https://patchblox.com/security/product/linux/nodejs",
      "release": "Debian 14",
      "fixedVersion": "22.22.2\u002Bdfsg\u002B~cs22.19.15-1",
      "supported": true
    }
  ],
  "cves": [
    {
      "cveId": "CVE-2026-21717",
      "url": "https://patchblox.com/security/cve/CVE-2026-21717",
      "title": "A flaw in V8\u0027s string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8\u0027s internal string table, an attacker can significantly degrade performance of the Node.js process.\n\nThe most common trigger is any endpoint that calls \u0060JSON.parse()\u0060 on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table.\n\nThis vulnerability affects **20.x, 22.x, 24.x, and 25.x**.",
      "priority": "High",
      "severity": "Moderate",
      "cvss": 7.5,
      "epss": 0.00273,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    }
  ],
  "dataAsOf": "2026-11-09T19:38:12Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}