Post

HashDoS occurs when an attacker paralyzes a server by sending a small amount of data that causes a huge amount of collisions in the server's hash tables. The standard mitigation is to use a seeded hash, with the seed randomly generated at startup to make the collisions unpredictable.

In CVE-2026-21717, the root cause lied in the unseeded hash V8 used for integer-looking strings, which needs to be quickly reversible to the original integer to maintain V8's performance optimizations. This poses a unique challenge not present in typical string hashing.

To address this, we designed a hash that alternates between xorshift and multiply with randomly generated multipliers. This descends from a family of mixers widely used in the industry. You can find cousins of it in Java's SplittableRandom, MurmurHash3's finalizer, and many others.