This vulnerability arises from a flaw in the V8 JavaScript engine's string hashing mechanism used by Node.js. Integer-like strings are hashed to their numeric values, making hash collisions trivially predictable. An attacker can craft input that triggers many such collisions in V8's internal string table, causing significant performance degradation of the Node.js process. The issue is especially relevant for endpoints that parse JSON from attacker-controlled input, as JSON.parse() internalizes short strings into the vulnerable hash table. Affected Node.js versions include 20.x, 22.x, 24.x, 25.x, and earlier major versions. The CVSS 3.0 score is 5.9 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network attack vector with high attack complexity and no privileges or user interaction required, impacting availability only. No patch or remediation details are currently provided.

The vulnerability allows an attacker to cause significant performance degradation of the Node.js process by triggering predictable hash collisions in V8's internal string table. This results in a denial-of-service-like condition affecting availability. There is no impact on confidentiality or integrity. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider limiting or validating attacker-controlled input that is parsed via JSON.parse() to reduce exposure. Monitor vendor channels for updates and patches addressing this vulnerability.