Preliminary research
HashDoS in V8's array-index string hash, and a seeded but invertible permutation as the fix
AI-collected research leads through 6 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.
A HackerOne report for CVE-2026-21717, a HashDoS in V8 affecting Node.js 20/22/24/25. V8's string hashing maps integer-like strings to their numeric value, so hash collisions are trivially predictable. A request that packs many colliding integer-like strings into V8's internal string table degrades the Node.js process's performance; the most common trigger is any endpoint that calls JSON.parse on attacker-controlled input, since JSON parsing internalizes short strings into that table.
Record
- Researcher
- sharp_edged
- Published by
- HackerOne
In the archive
Related sources
Tags
This page is the archive's own catalogue record. The research is the work of sharp_edged, first published at the original source. Preserved copies are kept so the citation survives its host.