Preliminary research
HashDoS in V8's array-index string hash, and a seeded but invertible permutation as the fix
Node.js disclosed on HackerOne: HashDoS in V8
AI-collected research leads through 22 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.
A HackerOne report for CVE-2026-21717, a HashDoS in V8 affecting Node.js 20/22/24/25. V8's string hashing maps integer-like strings to their numeric value, so hash collisions are trivially predictable. A request that packs many colliding integer-like strings into V8's internal string table degrades the Node.js process's performance; the most common trigger is any endpoint that calls JSON.parse on attacker-controlled input, since JSON parsing internalizes short strings into that table.
Record
- Document
- Node.js disclosed on HackerOne: HashDoS in V8
- Researcher
- sharp_edged
- Published by
- HackerOne
- Topic
- Crypto
In the archive
Related sources
- Node.js — Developing a minimally HashDoS resistant, yet quickly reversible integer hash for V8
- Hash analysis and benchmark data
Tags
This page is the archive's own catalogue record. The research is the work of sharp_edged, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .