Node.js vulnerabilities

Products

• Node.js 37
• Adm-zip 10

Newest

• cthackers adm-zip adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names CVE-2026-116137 6.3 MediumOctober 25, 2026
• cthackers adm-zip Adm-zip before 0.6.1 Privilege Escalation via keepOriginalPermission Setuid Bits CVE-2026-114105 6.9 MediumOctober 21, 2026
• cthackers adm-zip adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypass CVE-2026-114104 8.2 HighOctober 21, 2026
• cthackers adm-zip adm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync() CVE-2026-114103 6.9 MediumOctober 21, 2026
• cthackers adm-zip adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Event CVE-2026-114102 Public exploit 8.7 HighOctober 21, 2026
• cthackers adm-zip adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation CVE-2026-102282 Public exploitFix available 7.1 HighSeptember 29, 2026
• cthackers adm-zip adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Size CVE-2026-92000 Fix available 8.7 HighSeptember 15, 2026
• cthackers adm-zip adm-zip 0.5.9 through 0.6.0 Arbitrary File Overwrite via Symlink Following on Extraction CVE-2026-76845 Fix available 6.8 MediumAugust 24, 2026
• cthackers adm-zip adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS) CVE-2026-77301 Fix available 7.5 HighAugust 4, 2026
• node.js, nodejs node +1 more A vulnerability has been identified in Node.js, affecting users of the experimental permission... CVE-2024-22018 Fix available 2.9 LowJuly 10, 2024
• node.js, nodejs node, nodejs +2 more A security flaw in Node.js allows a bypass of network import restrictions. By embedding non... CVE-2024-22020 Fix available 6.5 MediumJuly 9, 2024
• node.js, nodejs node +1 more Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a... CVE-2024-27980 Fix available 8.1 HighJune 15, 2024
• go programming language golang, haskell process library, haskell programming language haskel +6 more +8 more Command injection vulnerability in programing languages on Microsoft Windows operating system. CVE-2024-3566 Fix available 9.8 CriticalApril 10, 2024
• node.js, nodejs node +1 more The Node.js Permission Model does not clarify in the documentation that wildcards should be only... CVE-2024-21890 Fix available 5.0 MediumFebruary 16, 2024
• node.js, nodejs node, nodejs +2 more Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs... CVE-2024-21891 Fix available 7.9 HighFebruary 16, 2024
• node.js, nodejs node, nodejs +2 more setuid() does not affect libuv's internal io_uring operations if initialized before the call to... CVE-2024-22017 Public exploitFix available 7.3 HighFebruary 16, 2024
• node.js, nodejs node, nodejs +2 more The permission model protects itself against path traversal attacks by calling path.resolve() on... CVE-2024-21896 Fix available 7.9 HighFebruary 16, 2024
• node.js, nodejs node, netapp astra control center +2 more A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP... CVE-2024-22019 Fix available 7.5 HighFebruary 16, 2024
• node.js, nodejs node +1 more On Linux, Node.js ignores certain environment variables if those may have been set by an... CVE-2024-21892 Fix available 7.5 HighFebruary 16, 2024
• node.js, nodejs node +1 more A vulnerability has been identified in Node.js version 20, affecting users of the experimental... CVE-2023-32005 Fix available 5.3 MediumSeptember 12, 2023
• node.js, nodejs node, fedoraproject fedora +2 more `fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a... CVE-2023-32003 Fix available 5.3 MediumAugust 15, 2023
• node.js, nodejs node, fedoraproject fedora +2 more A vulnerability has been discovered in Node.js version 20, specifically within the experimental... CVE-2023-32004 Fix available 8.8 HighAugust 15, 2023
• node.js, nodejs node, fedoraproject fedora +2 more The use of `module.constructor.createRequire()` can bypass the policy mechanism and require... CVE-2023-32006 Fix available 8.8 HighAugust 14, 2023
• node.js, nodejs node, nodejs +2 more The use of `Module._load()` can bypass the policy mechanism and require modules outside of the... CVE-2023-32002 Fix available 9.8 CriticalAugust 14, 2023
• node.js, nodejs node, nodejs +2 more A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental... CVE-2023-30587 Fix available 7.5 HighJuly 7, 2023
• node.js, nodejs node, nodejs +2 more A vulnerability has been discovered in Node.js version 20, specifically within the experimental... CVE-2023-30584 Fix available 7.7 HighJuly 7, 2023
• node.js, nodejs node, nodejs +2 more fs.openAsBlob() can bypass the experimental permission model when using the file system read... CVE-2023-30583 Fix available 7.5 HighJuly 7, 2023
• node.js, nodejs node, nodejs +2 more A vulnerability has been identified in Node.js version 20, affecting users of the experimental... CVE-2023-30582 Fix available 5.3 MediumJuly 7, 2023
• node.js, opensuse leap +1 more Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js... CVE-2019-5739 Fix available 7.5 HighMarch 20, 2019
• node.js, opensuse leap +1 more In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before... CVE-2019-5737 Public exploitFix available EPSS 16.2% 7.5 HighMarch 18, 2019
• node.js Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in... CVE-2018-12123 Fix available 4.3 MediumNovember 28, 2018
• node.js, suse enterprise storage, linux enterprise server +1 more +3 more Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial... CVE-2018-12122 Fix available EPSS 41.3% 7.5 HighNovember 28, 2018
• node.js, redhat enterprise linux, enterprise linux desktop +5 more +7 more Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with... CVE-2018-12121 Fix available EPSS 10.2% 7.5 HighNovember 28, 2018
• node.js Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by... CVE-2018-12120 Fix available 8.1 HighNovember 28, 2018
• node.js, suse enterprise storage, linux enterprise server +1 more +3 more Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can... CVE-2018-12116 Fix available 7.5 HighNovember 28, 2018
• node.js In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer... CVE-2018-7166 Fix available 7.5 HighAugust 21, 2018
• node.js, redhat openshift container platform +1 more In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding ... CVE-2018-12115 Fix available 7.5 HighAugust 21, 2018
• adm-zip project adm-zip Arbitrary File Write in adm-zip CVE-2018-1002204 Fix available EPSS 13.5% 5.5 MediumJuly 25, 2018
• node.js unzipper Arbitrary File Write via Archive Extraction in unzipper CVE-2018-1002203 Fix available EPSS 10.6% 5.5 MediumJuly 25, 2018
• node.js Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could... CVE-2018-7167 Fix available 7.5 HighJune 13, 2018
• node.js Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug... CVE-2018-7164 Fix available 7.5 HighJune 13, 2018
• node.js All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can... CVE-2018-7162 Fix available 7.5 HighJune 13, 2018
• node.js All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. An attacker... CVE-2018-7161 Fix available 7.5 HighJune 13, 2018
• node.js Withdrawn Advisory: Node.js Inspector RCE via DNS Rebinding CVE-2018-7160 Fix available 8.8 HighMay 9, 2018
• node.js The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header,... CVE-2018-7159 Fix available 5.3 MediumApril 16, 2018
• node.js The `'path'` module in the Node.js 4.x release line contains a potential regular expression... CVE-2018-7158 Fix available 7.5 HighApril 16, 2018
• node.js Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the... CVE-2017-15897 Fix available 3.1 LowDecember 11, 2017
• node.js Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read()... CVE-2017-15896 Fix available 9.1 CriticalDecember 11, 2017