Skip to contentNodejs Node.js vulnerabilities
- nodejs node, node.js, fedoraproject fedora +2 morellhttp vulnerable to HTTP request smugglingCVE-2023-30589Fix available7.5 High
- nodejs node, node.js +1 moreWhen an invalid public key is used to create an x509 certificate using the crypto.X509Certificate...CVE-2023-30588Fix available5.3 Medium
- nodejs node, node.js +1 moreA vulnerability has been identified in the Node.js (.msi version) installation process,...CVE-2023-30585Fix available7.5 High
- nodejs node, node.js +1 moreThe use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism...CVE-2023-30581Fix available7.5 High
- nodejs node, node.js, debian linux +2 moreAn untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21...CVE-2023-23920Fix available4.2 Medium
- nodejs node, node.js +1 moreA cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in...CVE-2023-23919Fix available7.5 High
- nodejs node, node.js +1 moreA privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3...CVE-2023-23918Fix available7.5 High
- nodejs node.js, undici +1 moreCRLF Injection in Nodejs ‘undici’ via hostCVE-2023-23936Fix available6.5 Medium
- nodejs node, node.js, debian linux +2 moreA OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19...CVE-2022-43548Fix availableEPSS 14.9%8.1 High
- fedoraproject fedora, nodejs node.js, openssl +9 more +11 moreX.509 Email Address Variable Length Buffer OverflowCVE-2022-3786Public exploitFix availableEPSS 92.5%7.5 High
- openssl, fedoraproject fedora, netapp clustered data ontap +10 more +12 moreX.509 Email Address 4-byte Buffer OverflowCVE-2022-3602Public exploitFix availableEPSS 90.8%7.5 High
- nodejs node, node.js, debian linux +1 more +3 moreA weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with...CVE-2022-35255Fix available9.1 Critical
- llhttp, nodejs node, debian linux +2 more +4 moreThe llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that...CVE-2022-35256Fix available6.5 Medium
- nodejs node, node.js +1 moreNode.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows...CVE-2022-32223Public exploitFix available7.3 High
- nodejs node, node.js, siemens sinec ins +2 moreA cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0...CVE-2022-32222Fix available5.3 Medium
- llhttp, nodejs node, node.js +4 more +6 moreThe llhttp parser in the http module in Node v17.6.0 does not correctly handle multi-line...CVE-2022-32215Fix availableEPSS 70.2%6.5 Medium
- llhttp, nodejs node, node.js +2 more +4 morellhttp allows HTTP Request Smuggling via Improper Delimiting of Header FieldsCVE-2022-32214Fix availableEPSS 81.8%6.5 Medium
- llhttp, nodejs node, node.js +4 more +6 morellhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-EncodingCVE-2022-32213Fix availableEPSS 44.8%6.5 Medium
- nodejs node, node.js, debian linux +2 more +4 moreA OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due...CVE-2022-32212Fix available8.1 High
- openssl, debian linux, fedoraproject fedora +470 more +472 moreInfinite loop in BN_mod_sqrt() reachable when parsing certificatesCVE-2022-0778Public exploitFix availableEPSS 73.2%7.5 High
- nodejs node, node.js, debian linux +9 more +11 moreDue to the formatting logic of the "console.table()" function it was not safe to allow user...CVE-2022-21824Fix availableEPSS 21.5%8.2 High
- nodejs node, node.js, debian linux +7 more +9 moreModerate: nodejs:14 security updateCVE-2021-44533Fix available5.3 Medium
- nodejs node, node.js, debian linux +7 more +9 moreNode.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names)...CVE-2021-44532Fix availableEPSS 10.4%5.3 Medium
- nodejs node, node.js, oracle graalvm +6 more +8 moreAccepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to...CVE-2021-44531Fix available7.4 High
- openssl, netapp 500f firmware, a250 firmware +13 more +15 moreInvalid handling of X509_verify_cert() internal errors in libsslCVE-2021-4044Public exploitFix availableEPSS 50.1%7.5 High
- nodejs node, node.js, debian linux +5 more +7 moreNode.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an...CVE-2021-22940Fix availableEPSS 13.9%7.5 High
- nodejs node, node.js, debian linux +6 more +8 moreIf the Node.js https API was used incorrectly and "undefined" was in passed for the ...CVE-2021-22939Fix availableEPSS 14.7%5.3 Medium
- nodejs node, node.js, netapp active iq unified manager +8 more +10 moreNode.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS,...CVE-2021-22931Fix availableEPSS 22.0%9.8 Critical
- c-ares, fedoraproject fedora, nodejs node.js +14 more +16 moreA flaw was found in c-ares library, where a missing input validation check of host names returned...CVE-2021-3672Fix available5.6 Medium
- nodejs node, node.js, debian linux +2 more +4 moreUse After Free in node.jsCVE-2021-22930Fix availableEPSS 36.5%9.8 Critical
- nodejs node, node.js, siemens sinec infrastructure network services +2 moreIncorrect Permission Assignment for Critical Resource in NodeCVE-2021-22921Fix available7.8 High
- nodejs node, node.js, siemens sinec infrastructure network services +2 moreOut-of-Bounds Read in Node.jsCVE-2021-22918Fix availableEPSS 23.1%5.3 Medium
- openssl, fedoraproject fedora, freebsd +30 more +32 moreCA certificate check bypass with X509_V_FLAG_X509_STRICTCVE-2021-3450Public exploitFix availableEPSS 18.3%7.4 High
- openssl, checkpoint multi-domain management firmware, quantum security gateway firmware +103 more +105 moreNULL pointer deref in signature_algorithms processingCVE-2021-3449Public exploitFix availableEPSS 63.5%5.9 Medium
- nodejs node, node.js, fedoraproject fedora +11 more +13 moreNode.js badCVE-2021-22884Fix availableEPSS 36.8%7.5 High
- nodejs node, node.js, fedoraproject fedora +7 more +9 moreNode.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack...CVE-2021-22883Fix availableEPSS 77.4%7.5 High
- openssl, debian linux, fujitsu m10-1 firmware +18 more +20 moreInteger overflow in CipherUpdateCVE-2021-23840Public exploitFix availableEPSS 51.1%7.5 High
- nodejs node, node.js, debian linux +3 more +5 moreNode.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in...CVE-2020-8287Public exploitFix availableEPSS 16.3%6.5 Medium
- nodejs node, node.js, debian linux +3 more +5 moreNode.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug...CVE-2020-8265Fix available8.1 High
- openssl, debian linux, fedoraproject fedora +41 more +43 moreEDIPARTYNAME NULL pointer dereferenceCVE-2020-1971Public exploitFix available5.9 Medium
- nodejs node, node.js, c-ares project c-ares +6 more +8 moreUncontrolled Resource Consumption in nodeCVE-2020-8277Public exploitFix availableEPSS 54.2%7.5 High
- nodejs node, node.js, fedoraproject fedora +1 more +3 moreNode.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver...CVE-2020-8201Fix available7.4 High
- nodejs node, node.js, fedoraproject fedora +1 more +3 moreThe implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js...CVE-2020-8252Fix available7.8 High
- nodejs node, node.js, fedoraproject fedora +2 moreNode.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests...CVE-2020-8251Fix available7.5 High
- nodejs node.js, oracle banking extensibility workbench, blockchain platform +2 more +4 moreTLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and ...CVE-2020-8172Fix available7.4 High
- netapp active iq unified manager, oncommand insight, oncommand workflow automation +6 more +8 morenapi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0,...CVE-2020-8174Fix available8.1 High
- nghttp2, debian linux, fedoraproject fedora +7 more +9 moreDenial of service in nghttp2CVE-2020-11080Fix available3.7 Low
- icu-project international components for unicode, canonical ubuntu linux, debian linux +11 more +13 moreAn issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An...CVE-2020-10531Fix available8.8 High
- libuv, nodejs node.js +1 moreThe uv_rwlock_t fallback implementation for Windows XP and Server 2003 in libuv before 1.7.4 does...CVE-2014-9748Fix available8.1 High
- nodejs node, debian linux, nodejs node.js +5 more +7 moreIncluding trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of...CVE-2019-15606Fix availableEPSS 20.0%9.8 Critical
- Show moreLoading…