ALPINE-CVE-2026-21712

ALPINE-CVE-2026-21712

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.

CVSS 6.5 · Medium · Fix available

Published

2026-03-30T16:16:03.510Z

Updated

2026-10-01T02:17:49.204907929Z

Stack: system

Check your server →