Skip to contentNodejs Node vulnerabilities
- nodejs node, node.js, debian linux +2 moreA OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19...CVE-2022-43548Fix availableEPSS 14.9%8.1 High
- fedoraproject fedora, nodejs node.js, openssl +9 more +11 moreX.509 Email Address Variable Length Buffer OverflowCVE-2022-3786Public exploitFix availableEPSS 92.5%7.5 High
- openssl, fedoraproject fedora, netapp clustered data ontap +10 more +12 moreX.509 Email Address 4-byte Buffer OverflowCVE-2022-3602Public exploitFix availableEPSS 90.8%7.5 High
- nodejs node, node.js, debian linux +1 more +3 moreA weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with...CVE-2022-35255Fix available9.1 Critical
- llhttp, nodejs node, debian linux +2 more +4 moreThe llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that...CVE-2022-35256Fix available6.5 Medium
- nodejs node, node.js +1 moreNode.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows...CVE-2022-32223Public exploitFix available7.3 High
- nodejs node, node.js, siemens sinec ins +2 moreA cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0...CVE-2022-32222Fix available5.3 Medium
- llhttp, nodejs node, node.js +4 more +6 moreThe llhttp parser in the http module in Node v17.6.0 does not correctly handle multi-line...CVE-2022-32215Fix availableEPSS 70.2%6.5 Medium
- llhttp, nodejs node, node.js +2 more +4 morellhttp allows HTTP Request Smuggling via Improper Delimiting of Header FieldsCVE-2022-32214Fix availableEPSS 81.8%6.5 Medium
- llhttp, nodejs node, node.js +4 more +6 morellhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-EncodingCVE-2022-32213Fix availableEPSS 44.8%6.5 Medium
- nodejs node, node.js, debian linux +2 more +4 moreA OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due...CVE-2022-32212Fix available8.1 High
- openssl, debian linux, fedoraproject fedora +470 more +472 moreInfinite loop in BN_mod_sqrt() reachable when parsing certificatesCVE-2022-0778Public exploitFix availableEPSS 73.2%7.5 High
- nodejs node, node.js, debian linux +9 more +11 moreDue to the formatting logic of the "console.table()" function it was not safe to allow user...CVE-2022-21824Fix availableEPSS 21.5%8.2 High
- nodejs node, node.js, debian linux +7 more +9 moreModerate: nodejs:14 security updateCVE-2021-44533Fix available5.3 Medium
- nodejs node, node.js, debian linux +7 more +9 moreNode.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names)...CVE-2021-44532Fix availableEPSS 10.4%5.3 Medium
- nodejs node, node.js, oracle graalvm +6 more +8 moreAccepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to...CVE-2021-44531Fix available7.4 High
- openssl, netapp 500f firmware, a250 firmware +13 more +15 moreInvalid handling of X509_verify_cert() internal errors in libsslCVE-2021-4044Public exploitFix availableEPSS 50.1%7.5 High
- llhttp, debian linux, nodejs node +1 more +3 moreThe parser in accepts requests with a space (SP) right after the header name before the colon....CVE-2021-22959Fix available6.5 Medium
- llhttp, debian linux, nodejs node +1 more +3 moreThe parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body...CVE-2021-22960Fix available6.5 Medium
- nodejs node, node.js, debian linux +5 more +7 moreNode.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an...CVE-2021-22940Fix availableEPSS 13.9%7.5 High
- nodejs node, node.js, debian linux +6 more +8 moreIf the Node.js https API was used incorrectly and "undefined" was in passed for the ...CVE-2021-22939Fix availableEPSS 14.7%5.3 Medium
- nodejs node, node.js, netapp active iq unified manager +8 more +10 moreNode.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS,...CVE-2021-22931Fix availableEPSS 22.0%9.8 Critical
- c-ares, fedoraproject fedora, nodejs node.js +14 more +16 moreA flaw was found in c-ares library, where a missing input validation check of host names returned...CVE-2021-3672Fix available5.6 Medium
- nodejs node, node.js, debian linux +2 more +4 moreUse After Free in node.jsCVE-2021-22930Fix availableEPSS 36.5%9.8 Critical
- nodejs node, node.js, siemens sinec infrastructure network services +2 moreIncorrect Permission Assignment for Critical Resource in NodeCVE-2021-22921Fix available7.8 High
- nodejs node, node.js, siemens sinec infrastructure network services +2 moreOut-of-Bounds Read in Node.jsCVE-2021-22918Fix availableEPSS 23.1%5.3 Medium
- openssl, fedoraproject fedora, freebsd +30 more +32 moreCA certificate check bypass with X509_V_FLAG_X509_STRICTCVE-2021-3450Public exploitFix availableEPSS 18.3%7.4 High
- openssl, checkpoint multi-domain management firmware, quantum security gateway firmware +103 more +105 moreNULL pointer deref in signature_algorithms processingCVE-2021-3449Public exploitFix availableEPSS 63.5%5.9 Medium
- nodejs node, node.js, fedoraproject fedora +11 more +13 moreNode.js badCVE-2021-22884Fix availableEPSS 36.8%7.5 High
- nodejs node, node.js, fedoraproject fedora +7 more +9 moreNode.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack...CVE-2021-22883Fix availableEPSS 77.4%7.5 High
- openssl, debian linux, fujitsu m10-1 firmware +18 more +20 moreInteger overflow in CipherUpdateCVE-2021-23840Public exploitFix availableEPSS 51.1%7.5 High
- nodejs node, node.js, debian linux +3 more +5 moreNode.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in...CVE-2020-8287Public exploitFix availableEPSS 16.3%6.5 Medium
- nodejs node, node.js, debian linux +3 more +5 moreNode.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug...CVE-2020-8265Fix available8.1 High
- openssl, debian linux, fedoraproject fedora +41 more +43 moreEDIPARTYNAME NULL pointer dereferenceCVE-2020-1971Public exploitFix available5.9 Medium
- nodejs node, node.js, c-ares project c-ares +6 more +8 moreUncontrolled Resource Consumption in nodeCVE-2020-8277Public exploitFix availableEPSS 54.2%7.5 High
- nodejs node, node.js, fedoraproject fedora +1 more +3 moreNode.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver...CVE-2020-8201Fix available7.4 High
- nodejs node, node.js, fedoraproject fedora +1 more +3 moreThe implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js...CVE-2020-8252Fix available7.8 High
- nodejs node, node.js, fedoraproject fedora +2 moreNode.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests...CVE-2020-8251Fix available7.5 High
- nodejs node.js, oracle banking extensibility workbench, blockchain platform +2 more +4 moreTLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and ...CVE-2020-8172Fix available7.4 High
- netapp active iq unified manager, oncommand insight, oncommand workflow automation +6 more +8 morenapi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0,...CVE-2020-8174Fix available8.1 High
- nghttp2, debian linux, fedoraproject fedora +7 more +9 moreDenial of service in nghttp2CVE-2020-11080Fix available3.7 Low
- icu-project international components for unicode, canonical ubuntu linux, debian linux +11 more +13 moreAn issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An...CVE-2020-10531Fix available8.8 High
- libuv, nodejs node.js +1 moreThe uv_rwlock_t fallback implementation for Windows XP and Server 2003 in libuv before 1.7.4 does...CVE-2014-9748Fix available8.1 High
- nodejs node, debian linux, nodejs node.js +5 more +7 moreIncluding trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of...CVE-2019-15606Fix availableEPSS 20.0%9.8 Critical
- nodejs node, node.js, debian linux +8 more +10 moreImproper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when...CVE-2019-15604Fix availableEPSS 20.0%7.5 High
- nodejs node, node.js, debian linux +11 more +13 moreHTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer...CVE-2019-15605Public exploitFix availableEPSS 57.1%9.8 Critical
- apache traffic server, apple swiftnio, canonical ubuntu linux +15 more +17 moreSome HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of serviceCVE-2019-9518Fix availableEPSS 25.4%7.5 High
- apache http server, traffic server, apple swiftnio +20 more +22 moreSome HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of serviceCVE-2019-9517Fix availableEPSS 27.0%7.5 High
- apache traffic server, apple swiftnio, canonical ubuntu linux +16 more +18 moreSome HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of serviceCVE-2019-9516Fix availableEPSS 57.5%7.5 High
- apache traffic server, apple swiftnio, canonical ubuntu linux +19 more +21 moreSome HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of serviceCVE-2019-9515Fix availableEPSS 87.3%7.5 High
- Show moreLoading…