Node.js · Report #3546390

Assertion error in node_url.cc via malformed URL format leads to Node.js crash

Validstatus

mediumseverity

40upvotes

26 Mar 2026disclosed

Summary

A flaw in Node.js URL processing causes an assertion failure in native code when url.format() is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.

This vulnerability affects 24.x and 25.x.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original