Nodejs Node vulnerabilities

• nodejs node A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not... CVE-2026-106071 Public exploitFix available 3.6 LowOctober 23, 2026
• nodejs node A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the... CVE-2026-106070 Public exploitFix available 3.7 LowOctober 23, 2026
• nodejs node A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to... CVE-2026-106072 Public exploitFix available 6.7 MediumOctober 23, 2026
• nodejs node A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, ... CVE-2026-106074 Public exploitFix available 4.8 MediumOctober 23, 2026
• nodejs node A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the... CVE-2026-106073 Public exploitFix available 3.3 LowOctober 23, 2026
• nodejs node A flaw in Node.js TLS hostname verification can cause a server certificate to be validated... CVE-2026-106069 Public exploitFix available 7.4 HighOctober 23, 2026
• nodejs node A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address... CVE-2026-105483 Public exploitFix available 7.4 HighOctober 23, 2026
• nodejs node A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated... CVE-2026-105482 Public exploitFix available 7.4 HighOctober 23, 2026
• nodejs node A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response... CVE-2026-105481 Public exploitFix available 6.5 MediumOctober 23, 2026
• nodejs node A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding... CVE-2026-48932 Fix available 3.7 LowAugust 13, 2026
• nodejs node A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly... CVE-2026-56848 Public exploitFix available 7.5 HighAugust 1, 2026
• nodejs node A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in... CVE-2026-58045 Public exploitFix available 6.2 MediumJuly 31, 2026
• nodejs node A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding... CVE-2026-58044 Public exploitFix available 3.7 LowJuly 31, 2026
• nodejs node A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response... CVE-2026-58042 Public exploitFix available 5.9 MediumJuly 31, 2026
• nodejs node A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync... CVE-2026-58041 Public exploitFix available 5.3 MediumJuly 31, 2026
• nodejs node A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory... CVE-2026-56846 Public exploitFix available 7.5 HighJuly 31, 2026
• nodejs node A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites)... CVE-2026-58039 Public exploitFix available 3.3 LowJuly 31, 2026
• nodejs node, node.js +1 more A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree... CVE-2026-58043 Public exploitFix available 7.5 HighJuly 30, 2026
• nodejs node, node.js +1 more A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions,... CVE-2026-56850 Public exploitFix available 4.1 MediumJuly 30, 2026
• nodejs node, node.js +1 more A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()`... CVE-2026-56847 Public exploitFix available 3.3 LowJuly 30, 2026
• nodejs node An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname... CVE-2026-58040 Public exploitFix available 6.3 MediumJuly 30, 2026
• nodejs node, node.js +1 more A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before... CVE-2026-48931 Fix available 3.7 LowJune 20, 2026
• nodejs node, node.js +1 more A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a... CVE-2026-48937 Fix available 5.3 MediumJune 18, 2026
• nodejs node, node.js +1 more A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()`... CVE-2026-48617 Fix available 1.8 LowJune 18, 2026
• andybalholm brotli, 7-zip p7zip, anthropic bun +34 more +36 more Out-of-Bounds Write in Google Brotli Decoder CVE-2026-111497 In KEVPublic exploitFix available EPSS 82.6% 9.2 CriticalApril 27, 2026
• nodejs node, node.js +1 more A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket... CVE-2026-48936 Fix available 3.3 LowApril 21, 2026
• nodejs node, node.js +1 more A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was... CVE-2026-48935 Fix available 3.3 LowApril 21, 2026
• nodejs node, node.js +1 more A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.... CVE-2026-48934 Fix available 4.3 MediumApril 21, 2026
• nodejs node, node.js, red hat enterprise linux 10 +4 more +6 more A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt(... CVE-2026-48933 Fix available 7.5 HighApril 21, 2026
• nodejs node, node.js +1 more A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent... CVE-2026-48930 Fix available 5.6 MediumApril 21, 2026
• nodejs node, node.js +1 more A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context... CVE-2026-48928 Fix available 4.2 MediumApril 21, 2026
• nodejs node, node.js +1 more A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames,... CVE-2026-48619 Fix available 5.3 MediumApril 21, 2026
• nodejs node, node.js, red hat enterprise linux 10 +4 more +6 more A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead... CVE-2026-48618 Fix available 7.7 HighApril 21, 2026
• nodejs node, node.js +1 more A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL... CVE-2026-48615 Fix available 5.9 MediumApril 21, 2026
• nodejs node, node.js +1 more A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server... CVE-2026-21711 Fix available 5.3 MediumMarch 29, 2026
• nodejs node, node.js, red hat enterprise linux 10 +7 more +9 more A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received... CVE-2026-21710 Public exploitFix available EPSS 25.4% 7.5 HighMarch 26, 2026
• nodejs node, node.js +1 more A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user... CVE-2026-21713 Fix available 5.9 MediumMarch 26, 2026
• nodejs node, node.js +1 more A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream... CVE-2026-21714 Fix available 5.3 MediumMarch 26, 2026
• nodejs node, node.js +1 more A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()`... CVE-2026-21715 Fix available 3.3 LowMarch 26, 2026
• nodejs node, node.js +1 more An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the... CVE-2026-21716 Fix available 3.3 LowMarch 26, 2026
• nodejs node, node.js +1 more A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric... CVE-2026-21717 Public exploitFix available 5.9 MediumMarch 26, 2026
• nodejs node, node.js +1 more A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass... CVE-2026-21636 Public exploitFix available 5.8 MediumJanuary 18, 2026
• nodejs node, node.js +1 more A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a... CVE-2026-21637 Fix available 5.9 MediumJanuary 17, 2026
• nodejs node, node.js +1 more We have identified a bug in Node.js error handling where "Maximum call stack size exceeded"... CVE-2025-59466 Fix available 5.9 MediumJanuary 17, 2026
• nodejs node, node.js, red hat enterprise linux 10 +6 more +8 more A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to... CVE-2025-59465 Fix available 7.5 HighJanuary 17, 2026
• nodejs node, node.js +1 more A flaw in Node.js's permission model allows a file's access and modification timestamps to be... CVE-2025-55132 Fix available 2.8 LowJanuary 17, 2026
• nodejs node, red hat enterprise linux 10, enterprise linux 10.0 extended update support +5 more +7 more A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are... CVE-2025-55131 Fix available 7.1 HighJanuary 17, 2026
• nodejs node, node.js, red hat enterprise linux 10 +6 more +8 more A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow... CVE-2025-55130 Public exploitFix available 7.1 HighJanuary 17, 2026
• nodejs node, nodejs +1 more An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting... CVE-2025-27210 Public exploitFix available EPSS 14.3% 7.5 HighJuly 18, 2025
• nodejs node The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash... CVE-2025-27209 Fix available 7.5 HighJuly 18, 2025
• Show olderLoading…