Nodejs vulnerabilities

Products

• Node.js 188
• Node 130
• Undici 55
• Nodejs 19

Newest

• nodejs node A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not... CVE-2026-106071 Public exploitFix available 3.6 LowOctober 23, 2026
• nodejs node A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the... CVE-2026-106070 Public exploitFix available 3.7 LowOctober 23, 2026
• nodejs node A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to... CVE-2026-106072 Public exploitFix available 6.7 MediumOctober 23, 2026
• nodejs node A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, ... CVE-2026-106074 Public exploitFix available 4.8 MediumOctober 23, 2026
• nodejs node A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the... CVE-2026-106073 Public exploitFix available 3.3 LowOctober 23, 2026
• nodejs node A flaw in Node.js TLS hostname verification can cause a server certificate to be validated... CVE-2026-106069 Public exploitFix available 7.4 HighOctober 23, 2026
• nodejs node A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address... CVE-2026-105483 Public exploitFix available 7.4 HighOctober 23, 2026
• nodejs node A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated... CVE-2026-105482 Public exploitFix available 7.4 HighOctober 23, 2026
• nodejs node A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response... CVE-2026-105481 Public exploitFix available 6.5 MediumOctober 23, 2026
• nodejs undici undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor CVE-2026-87029 Fix available 5.9 MediumOctober 15, 2026
• nodejs undici undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering CVE-2026-109932 Fix available 5.9 MediumOctober 15, 2026
• nodejs undici undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation CVE-2026-87018 Fix available 7.5 HighOctober 15, 2026
• nodejs undici undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent CVE-2026-109383 Fix available 7.4 HighOctober 15, 2026
• nodejs undici undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects CVE-2026-109829 Fix available 7.4 HighOctober 15, 2026
• nodejs undici undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens CVE-2026-109841 Fix available 5.9 MediumOctober 15, 2026
• nodejs undici undici vulnerable to Denial of Service via unbounded memory in the EventSource parser CVE-2026-109924 Fix available 5.9 MediumOctober 15, 2026
• nodejs undici undici vulnerable to Denial of Service via unhandled error on excessive content-encodings CVE-2026-109869 Fix available 7.5 HighOctober 15, 2026
• nodejs undici undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake CVE-2026-109855 Fix available 7.5 HighOctober 10, 2026
• nodejs undici undici vulnerable to downstream response splitting via retry interceptor CVE-2026-18540 Fix available 3.7 LowSeptember 4, 2026
• nodejs undici undici vulnerable to Denial of Service via unrequested WebSocket subprotocol CVE-2026-19534 Fix available 7.5 HighSeptember 4, 2026
• nodejs undici undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool CVE-2026-84961 Fix available 7.4 HighSeptember 4, 2026
• nodejs undici undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression CVE-2026-85024 Fix available 5.9 MediumSeptember 4, 2026
• nodejs undici undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors CVE-2026-85152 Fix available 7.4 HighAugust 13, 2026
• nodejs undici undici vulnerable to Denial of Service via WebSocketStream unclean close CVE-2026-85014 Fix available 5.9 MediumAugust 13, 2026
• nodejs undici undici vulnerable to caching and replay of unsafe HTTP method responses CVE-2026-85008 Fix available 3.7 LowAugust 13, 2026
• nodejs undici undici vulnerable to response truncation via oversized chunked responses in the dump interceptor CVE-2026-84947 Fix available 3.7 LowAugust 13, 2026
• nodejs undici undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches CVE-2026-84933 Fix available 6.5 MediumAugust 13, 2026
• nodejs undici undici vulnerable to Denial of Service via unbounded decompression of compressed responses CVE-2026-84890 Fix available 5.9 MediumAugust 13, 2026
• nodejs node A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding... CVE-2026-48932 Fix available 3.7 LowAugust 13, 2026
• nodejs undici undici vulnerable to Denial of Service via orphaned RetryHandler response body CVE-2026-18149 Fix available 5.9 MediumAugust 13, 2026
• nodejs node A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly... CVE-2026-56848 Public exploitFix available 7.5 HighAugust 1, 2026
• nodejs node A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in... CVE-2026-58045 Public exploitFix available 6.2 MediumJuly 31, 2026
• nodejs node A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding... CVE-2026-58044 Public exploitFix available 3.7 LowJuly 31, 2026
• nodejs node A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response... CVE-2026-58042 Public exploitFix available 5.9 MediumJuly 31, 2026
• nodejs node A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync... CVE-2026-58041 Public exploitFix available 5.3 MediumJuly 31, 2026
• nodejs node A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory... CVE-2026-56846 Public exploitFix available 7.5 HighJuly 31, 2026
• nodejs node A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites)... CVE-2026-58039 Public exploitFix available 3.3 LowJuly 31, 2026
• nodejs node, node.js +1 more A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree... CVE-2026-58043 Public exploitFix available 7.5 HighJuly 30, 2026
• nodejs node, node.js +1 more A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions,... CVE-2026-56850 Public exploitFix available 4.1 MediumJuly 30, 2026
• nodejs node, node.js +1 more A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()`... CVE-2026-56847 Public exploitFix available 3.3 LowJuly 30, 2026
• nodejs node An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname... CVE-2026-58040 Public exploitFix available 6.3 MediumJuly 30, 2026
• nodejs undici undici vulnerable to CRLF Injection via blob-like body 'type' property CVE-2026-15157 Fix available 4.2 MediumJuly 29, 2026
• nodejs undici undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives CVE-2026-14643 Fix available 5.9 MediumJuly 29, 2026
• nodejs undici undici vulnerable to downstream response desynchronization via retry interceptor CVE-2026-16728 Fix available 4.8 MediumJuly 29, 2026
• nodejs undici undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields CVE-2026-16729 Fix available 4.8 MediumJuly 29, 2026
• nodejs undici undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives CVE-2026-13697 Fix available 7.4 HighJuly 29, 2026
• nodejs node, node.js +1 more A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before... CVE-2026-48931 Fix available 3.7 LowJune 20, 2026
• nodejs node, node.js +1 more A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a... CVE-2026-48937 Fix available 5.3 MediumJune 18, 2026
• nodejs node, node.js +1 more A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()`... CVE-2026-48617 Fix available 1.8 LowJune 18, 2026
• nodejs undici undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching CVE-2026-11525 Fix available 3.7 LowJune 17, 2026
• Show olderLoading…