CVE-2026-21710 is a denial of service vulnerability in Node.js HTTP servers caused by improper handling of a request header named '__proto__'. When an application accesses req.headersDistinct, the '__proto__' property resolves to Object.prototype instead of undefined, causing a push operation on a non-array and throwing a synchronous TypeError. This exception occurs inside a property getter and cannot be intercepted by error event listeners, requiring try/catch around every access to req.headersDistinct to handle it. The vulnerability affects Node.js versions 20.x, 22.x, 24.x, and 25.x. Red Hat has published advisories and errata addressing this issue with updated packages for affected distributions.

The vulnerability results in a denial of service condition by causing the Node.js HTTP server to throw an uncaught synchronous TypeError when processing specially crafted HTTP requests with a '__proto__' header. This disrupts normal server operation and cannot be handled by typical error event listeners, potentially causing application crashes or service interruptions. There is no indication of confidentiality or integrity impact.

Red Hat has released security updates addressing this vulnerability in their Node.js packages. Applying the official patches from Red Hat advisories (e.g., RHSA-2026:7310 and related errata) will remediate the issue. Until patched, applications can mitigate the impact by wrapping all accesses to req.headersDistinct in try/catch blocks, though this is a workaround rather than a full fix. Users should consult the Red Hat advisories for detailed update instructions and apply the updates promptly.