CWE-843
AllowedAccess of Resource Using Incompatible Type ('Type Confusion')
Abstraction: Base · Status: Incomplete
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
1062 vulnerabilities reference this CWE, most recent first.
GHSA-XV6W-GXJ8-V943
Vulnerability from github – Published: 2026-03-30 21:31 – Updated: 2026-06-30 03:36A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request is received with a header named __proto__ and the application accesses req.headersDistinct.
When this occurs, dest["__proto__"] resolves to Object.prototype rather than undefined, causing .push() to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by error event listeners, meaning it cannot be handled without wrapping every req.headersDistinct access in a try/catch.
- This vulnerability affects all Node.js HTTP servers on 20.x, 22.x, 24.x, and v25.x
{
"affected": [],
"aliases": [
"CVE-2026-21710"
],
"database_specific": {
"cwe_ids": [
"CWE-770",
"CWE-843"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-30T20:16:18Z",
"severity": "HIGH"
},
"details": "A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.\n\nWhen this occurs, `dest[\"__proto__\"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`.\n\n* This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**",
"id": "GHSA-xv6w-gxj8-v943",
"modified": "2026-06-30T03:36:04Z",
"published": "2026-03-30T21:31:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21710"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21710.json"
},
{
"type": "WEB",
"url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453151"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-21710"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:9874"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:9711"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:8339"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:7983"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:7896"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:7675"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:7670"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:7350"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:7310"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:7302"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:7123"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:7080"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XXJV-VH49-QQ33
Vulnerability from github – Published: 2024-05-14 18:31 – Updated: 2024-07-09 12:30A vulnerability has been identified in PS/IGES Parasolid Translator Component (All versions < V27.1.215). The affected application contains a type confusion vulnerability while parsing IGS files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21562)
{
"affected": [],
"aliases": [
"CVE-2024-32057"
],
"database_specific": {
"cwe_ids": [
"CWE-843"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-14T16:16:56Z",
"severity": "HIGH"
},
"details": "A vulnerability has been identified in PS/IGES Parasolid Translator Component (All versions \u003c V27.1.215). The affected application contains a type confusion vulnerability while parsing IGS files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21562)",
"id": "GHSA-xxjv-vh49-qq33",
"modified": "2024-07-09T12:30:55Z",
"published": "2024-05-14T18:31:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32057"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-064222.html"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-976324.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.