Nodejs Node.js vulnerabilities

• nodejs node, node.js +1 more A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree... CVE-2026-58043 Public exploitFix available 7.5 HighJuly 30, 2026
• nodejs node, node.js +1 more A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions,... CVE-2026-56850 Public exploitFix available 4.1 MediumJuly 30, 2026
• nodejs node, node.js +1 more A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()`... CVE-2026-56847 Public exploitFix available 3.3 LowJuly 30, 2026
• nodejs node, node.js +1 more A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before... CVE-2026-48931 Fix available 3.7 LowJune 20, 2026
• nodejs node, node.js +1 more A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a... CVE-2026-48937 Fix available 5.3 MediumJune 18, 2026
• nodejs node, node.js +1 more A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()`... CVE-2026-48617 Fix available 1.8 LowJune 18, 2026
• andybalholm brotli, 7-zip p7zip, anthropic bun +34 more +36 more Out-of-Bounds Write in Google Brotli Decoder CVE-2026-111497 In KEVPublic exploitFix available EPSS 82.6% 9.2 CriticalApril 27, 2026
• nodejs node, node.js +1 more A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket... CVE-2026-48936 Fix available 3.3 LowApril 21, 2026
• nodejs node, node.js +1 more A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was... CVE-2026-48935 Fix available 3.3 LowApril 21, 2026
• nodejs node, node.js +1 more A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.... CVE-2026-48934 Fix available 4.3 MediumApril 21, 2026
• nodejs node, node.js, red hat enterprise linux 10 +4 more +6 more A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt(... CVE-2026-48933 Fix available 7.5 HighApril 21, 2026
• nodejs node, node.js +1 more A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent... CVE-2026-48930 Fix available 5.6 MediumApril 21, 2026
• nodejs node, node.js +1 more A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context... CVE-2026-48928 Fix available 4.2 MediumApril 21, 2026
• nodejs node, node.js +1 more A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames,... CVE-2026-48619 Fix available 5.3 MediumApril 21, 2026
• nodejs node, node.js, red hat enterprise linux 10 +4 more +6 more A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead... CVE-2026-48618 Fix available 7.7 HighApril 21, 2026
• nodejs node, node.js +1 more A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL... CVE-2026-48615 Fix available 5.9 MediumApril 21, 2026
• nodejs node, node.js +1 more A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server... CVE-2026-21711 Fix available 5.3 MediumMarch 29, 2026
• nodejs node, node.js, red hat enterprise linux 10 +7 more +9 more A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received... CVE-2026-21710 Public exploitFix available EPSS 25.4% 7.5 HighMarch 26, 2026
• nodejs node, node.js +1 more A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user... CVE-2026-21713 Fix available 5.9 MediumMarch 26, 2026
• nodejs node, node.js +1 more A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream... CVE-2026-21714 Fix available 5.3 MediumMarch 26, 2026
• nodejs node, node.js +1 more A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()`... CVE-2026-21715 Fix available 3.3 LowMarch 26, 2026
• nodejs node, node.js +1 more An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the... CVE-2026-21716 Fix available 3.3 LowMarch 26, 2026
• nodejs node, node.js +1 more A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric... CVE-2026-21717 Public exploitFix available 5.9 MediumMarch 26, 2026
• nodejs node, node.js +1 more A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass... CVE-2026-21636 Public exploitFix available 5.8 MediumJanuary 18, 2026
• nodejs node, node.js +1 more A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a... CVE-2026-21637 Fix available 5.9 MediumJanuary 17, 2026
• nodejs node, node.js +1 more We have identified a bug in Node.js error handling where "Maximum call stack size exceeded"... CVE-2025-59466 Fix available 5.9 MediumJanuary 17, 2026
• nodejs node, node.js, red hat enterprise linux 10 +6 more +8 more A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to... CVE-2025-59465 Fix available 7.5 HighJanuary 17, 2026
• nodejs node, node.js +1 more A flaw in Node.js's permission model allows a file's access and modification timestamps to be... CVE-2025-55132 Fix available 2.8 LowJanuary 17, 2026
• nodejs node, node.js, red hat enterprise linux 10 +6 more +8 more A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow... CVE-2025-55130 Public exploitFix available 7.1 HighJanuary 17, 2026
• nodejs node, node.js +1 more A vulnerability has been identified in Node.js, specifically affecting the handling of drive... CVE-2025-23084 Fix available 5.6 MediumJanuary 28, 2025
• go programming language golang, haskell process library, haskell programming language haskel +6 more +8 more Command injection vulnerability in programing languages on Microsoft Windows operating system. CVE-2024-3566 Fix available 9.8 CriticalApril 10, 2024
• nodejs node, node.js +1 more The team has identified a critical vulnerability in the http server of the most recent version of... CVE-2024-27982 Fix available 6.5 MediumApril 4, 2024
• node.js, nodejs node +1 more The Node.js Permission Model does not clarify in the documentation that wildcards should be only... CVE-2024-21890 Fix available 5.0 MediumFebruary 16, 2024
• node.js, nodejs node, nodejs +2 more Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs... CVE-2024-21891 Fix available 7.9 HighFebruary 16, 2024
• node.js, nodejs node, nodejs +2 more The permission model protects itself against path traversal attacks by calling path.resolve() on... CVE-2024-21896 Fix available 7.9 HighFebruary 16, 2024
• node.js, nodejs node, netapp astra control center +2 more A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP... CVE-2024-22019 Fix available 7.5 HighFebruary 16, 2024
• node.js, nodejs node +1 more On Linux, Node.js ignores certain environment variables if those may have been set by an... CVE-2024-21892 Fix available 7.5 HighFebruary 16, 2024
• nodejs node, node.js, fedoraproject fedora +2 more Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In... CVE-2023-39332 Fix available 9.8 CriticalOctober 18, 2023
• nodejs node, node.js +1 more A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit... CVE-2023-39331 Fix available 7.7 HighOctober 18, 2023
• nodejs node, node.js, fedoraproject fedora +2 more When the Node.js policy feature checks the integrity of a resource against a trusted manifest,... CVE-2023-38552 Fix available 7.5 HighOctober 18, 2023
• nodejs node, node.js +1 more The use of the deprecated API `process.binding()` can bypass the permission model through path... CVE-2023-32558 Fix available 7.5 HighSeptember 12, 2023
• node.js, nodejs node +1 more A vulnerability has been identified in Node.js version 20, affecting users of the experimental... CVE-2023-32005 Fix available 5.3 MediumSeptember 12, 2023
• node.js, nodejs node, fedoraproject fedora +2 more `fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a... CVE-2023-32003 Fix available 5.3 MediumAugust 15, 2023
• node.js, nodejs node, fedoraproject fedora +2 more A vulnerability has been discovered in Node.js version 20, specifically within the experimental... CVE-2023-32004 Fix available 8.8 HighAugust 15, 2023
• nodejs node, node.js, nodejs +2 more A privilege escalation vulnerability exists in the experimental policy mechanism in all active... CVE-2023-32559 Fix available 7.5 HighAugust 14, 2023
• node.js, nodejs node, fedoraproject fedora +2 more The use of `module.constructor.createRequire()` can bypass the policy mechanism and require... CVE-2023-32006 Fix available 8.8 HighAugust 14, 2023
• node.js, nodejs node, nodejs +2 more The use of `Module._load()` can bypass the policy mechanism and require modules outside of the... CVE-2023-32002 Fix available 9.8 CriticalAugust 14, 2023
• eclipse jetty, ietf http, http/2 +166 more +168 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2023-44487 In KEVPublic exploitFix available EPSS 100.0% 7.5 HighJuly 10, 2023
• nodejs node, node.js +1 more A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL... CVE-2023-30586 Fix available 7.5 HighJune 30, 2023
• nodejs node, node.js +1 more The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing... CVE-2023-30590 Fix available 7.5 HighJune 27, 2023
• Show olderLoading…