Node.js v24 HashDoS (CVE-2025-27209): How a V8 Hashing Change Reopened a Classic DoS Attack

In July 2025, a subtle change to the string hashing algorithm in the V8 JavaScript engine, adopted in Node.js v24.x, reopened the door to HashDoS, a classic denial-of-service attack. With it, a single HTTP request can bring down a Node.js server. The flaw is tracked as CVE-2025-27209, and its consequences are immediate and severe for any organization running modern Node.js applications.

Introduction

Node.js runs millions of web applications, APIs, and microservices worldwide. Its event-driven, non-blocking architecture makes it a popular choice for scalable server-side development. That reach also means a vulnerability in Node.js or one of its dependencies can have far-reaching consequences. Google maintains V8, the engine that executes JavaScript in Node.js, so a change in V8's internals can reach every Node.js deployment.

In July 2025, security researchers discovered that the new rapidhash string hashing algorithm in V8 (as shipped in Node.js v24.0.0) made it trivial for attackers to generate massive hash collisions. That brought back HashDoS, a problem previously thought solved. Remote attackers could degrade or crash Node.js services by sending crafted strings. The vulnerability is critical for any public-facing Node.js v24.x deployment.

Technical Information

Vulnerability Mechanism

CVE-2025-27209 comes from V8's switch to the rapidhash algorithm for string hashing, which first shipped in Node.js v24.0.0. Unlike the hash functions before it, rapidhash is deterministic and does not randomize input enough, which leaves it open to collision attacks. An attacker who controls the strings being hashed, such as HTTP headers, query parameters, or JSON keys, can craft inputs that all hash to the same value. That pushes JavaScript hash tables (objects and Maps) into their worst-case performance, where each lookup or insertion costs O(n) instead of O(1).

Exploitation Flow

1. The attacker crafts a set of strings known to collide under rapidhash.
2. The attacker sends these strings in requests to the target Node.js application, for example as HTTP headers or JSON keys.
3. Node.js processes the strings and inserts them into hash-based data structures.
4. Hash table performance collapses. The server spends excessive time resolving collisions, which exhausts the CPU and denies service.

Example Attack Code

// Example: Generating many colliding strings for rapidhash
const attackPayload = [];
for (let i = 0; i < 10000; i++) {
  attackPayload.push(`collision${i}`); // Crafted to collide
}
// Insert into a Map or object used by the server
attackPayload.forEach(str => someHashTable.set(str, 'payload'));

The attack needs neither knowledge of the internal hash seed nor authentication. Any endpoint that accepts user-controlled strings as keys is potentially vulnerable.

Root Cause

The rapidhash implementation lacks sufficient randomness and collision resistance. The V8 team did not initially treat this as a security issue, but the Node.js project saw the practical risk to server-side applications and assigned it a high-severity CVE.

Patch Information

The Node.js team has released version 24.4.1 to fix the HashDoS vulnerability in V8. It includes an updated V8 engine with a revised string hashing mechanism, which replaces the collision-prone rapidhash implementation with a more secure hashing algorithm. The new algorithm mitigates the risk of denial-of-service (DoS) attacks through hash collisions. If you run Node.js v24.x, you should upgrade to Node.js v24.4.1 as a priority. Details are in the Node.js July 2025 Security Releases advisory.

Affected Systems and Versions

CVE-2025-27209 affects:

• Node.js v24.0.0 through v24.4.0 (inclusive)
• All platforms and configurations running these versions
• Any application that processes user-controlled strings as keys in hash-based data structures

Node.js versions before v24.0.0 and patched releases (v24.4.1 and later) are not vulnerable.

Vendor Security History

Node.js, a project under the OpenJS Foundation, has a mature and transparent security process. The project maintains a public vulnerability disclosure program, coordinates closely with upstream dependencies like V8, and issues regular security advisories. Node.js has dealt with similar hash collision issues before, and it responded quickly to CVE-2025-27209, shipping a fix within weeks. The incident also shows how hard it is to secure complex, layered open-source stacks, where an upstream change can have unexpected effects downstream.

References

• Node.js July 2025 Security Releases
• NVD Entry for CVE-2025-27209
• HackerOne Report #3131758
• Webasha: CVE-2025-27209 and CVE-2025-27210 Technical Analysis
• API Security Blog: Node.js HashDoS in V8

Source: This report was created using AI

If you have suggestions for improvement or feedback, please email us at [email protected]