Skip to contentNodejs vulnerabilities
Newest
- nodejs node, node.js, debian linux +11 more +13 moreHTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer...CVE-2019-15605Public exploitFix availableEPSS 57.1%9.8 Critical
- apache traffic server, apple swiftnio, canonical ubuntu linux +15 more +17 moreSome HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of serviceCVE-2019-9518Fix availableEPSS 25.4%7.5 High
- apache http server, traffic server, apple swiftnio +20 more +22 moreSome HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of serviceCVE-2019-9517Fix availableEPSS 27.0%7.5 High
- apache traffic server, apple swiftnio, canonical ubuntu linux +16 more +18 moreSome HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of serviceCVE-2019-9516Fix availableEPSS 57.5%7.5 High
- apache traffic server, apple swiftnio, canonical ubuntu linux +19 more +21 moreSome HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of serviceCVE-2019-9515Fix availableEPSS 87.3%7.5 High
- apache traffic server, apple swiftnio, canonical ubuntu linux +25 more +27 moreSome HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of serviceCVE-2019-9514Fix availableEPSS 82.8%7.5 High
- apache traffic server, apple swiftnio, canonical ubuntu linux +17 more +19 moreSome HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of serviceCVE-2019-9513Public exploitFix availableEPSS 81.6%7.5 High
- apache traffic server, apple swiftnio, debian linux +1 more +3 moreSome HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of serviceCVE-2019-9512Fix availableEPSS 83.4%7.5 High
- apache traffic server, apple swiftnio, canonical ubuntu linux +17 more +19 moreSome HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of serviceCVE-2019-9511Public exploitFix availableEPSS 59.5%7.5 High
- nodejs node.jsOut-of-bounds Read in stringstreamCVE-2018-21270Fix available6.5 Medium
- node.js, opensuse leap +1 moreKeep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js...CVE-2019-5739Fix available7.5 High
- node.js, opensuse leap +1 moreIn Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before...CVE-2019-5737Public exploitFix availableEPSS 16.2%7.5 High
- openssl, canonical ubuntu linux, debian linux +79 more +81 more0-byte record padding oracleCVE-2019-1559Fix availableEPSS 17.1%5.9 Medium
- node.jsNode.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in...CVE-2018-12123Fix available4.3 Medium
- node.js, suse enterprise storage, linux enterprise server +1 more +3 moreNode.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial...CVE-2018-12122Fix availableEPSS 41.3%7.5 High
- node.js, redhat enterprise linux, enterprise linux desktop +5 more +7 moreNode.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with...CVE-2018-12121Fix availableEPSS 10.2%7.5 High
- node.jsNode.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by...CVE-2018-12120Fix available8.1 High
- node.js, suse enterprise storage, linux enterprise server +1 more +3 moreNode.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can...CVE-2018-12116Fix available7.5 High
- canonical ubuntu linux, debian linux, nodejs node.js +17 more +19 moreSimultaneous Multi-threading (SMT) in processors can enable local users to exploit software...CVE-2018-5407Public exploitFix available4.7 Medium
- openssl, canonical ubuntu linux, debian linux +16 more +18 moreTiming attack against DSACVE-2018-0734Fix availableEPSS 12.2%5.9 Medium
- openssl, canonical ubuntu linux, debian linux +19 more +21 moreTiming attack against ECDSA signature generationCVE-2018-0735Fix available5.9 Medium
- node.jsIn all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer...CVE-2018-7166Fix available7.5 High
- node.js, redhat openshift container platform +1 moreIn all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding ...CVE-2018-12115Fix available7.5 High
- node.jsCalling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could...CVE-2018-7167Fix available7.5 High
- node.jsNode.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug...CVE-2018-7164Fix available7.5 High
- node.jsAll versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can...CVE-2018-7162Fix available7.5 High
- node.jsAll versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. An attacker...CVE-2018-7161Fix available7.5 High
- openssl, canonical ubuntu linux, debian linux +1 more +3 moreClient DoS due to large DH parameterCVE-2018-0732Fix availableEPSS 47.0%7.5 High
- sync-exec project sync-exec, hackerone sync-exec node module, nodejs node.js +2 moreTmp files readable by other users in sync-execCVE-2017-160246.5 Medium
- node.jsWithdrawn Advisory: Node.js Inspector RCE via DNS RebindingCVE-2018-7160Fix available8.8 High
- node.jsThe HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header,...CVE-2018-7159Fix available5.3 Medium
- node.jsThe `'path'` module in the Node.js 4.x release line contains a potential regular expression...CVE-2018-7158Fix available7.5 High
- nghttp2, debian linux, nodejs node.js +2 morenghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20...CVE-2018-1000168Fix availableEPSS 10.6%7.5 High
- node.jsNode.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the...CVE-2017-15897Fix available3.1 Low
- node.jsNode.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read()...CVE-2017-15896Fix available9.1 Critical
- openssl, debian linux, nodejs node.js +2 moreThere is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation...CVE-2017-3738Fix availableEPSS 13.4%5.9 Medium
- nodejs node.js, siemens cadra +1 moreNode.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a...CVE-2017-14919Fix available7.5 High
- nodejs node.jsDirectory Traversal in stCVE-2014-3744Fix availableEPSS 34.0%7.5 High
- nodejs node.jsNode.js 4.0.0, 4.1.0, and 4.1.1 allows remote attackers to cause a denial of service.CVE-2015-7384Fix available7.5 High
- nodejs node.jsNode.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change...CVE-2017-14849Public exploitEPSS 54.4%7.5 High
- debian linux, nodejs node.js, uronode uro node +2 morenode 0.3.2 and URONode before 1.0.5r3 allows remote attackers to cause a denial of service ...CVE-2015-29276.5 Medium
- nodejs node.jsNode.js v4.0 through v4.8.3, all versions of v5.x, v6.0 through v6.11.0, v7.0 through v7.10.0,...CVE-2017-11499Public exploitFix available7.5 High
- c-ares, nodejs node.js +1 moreThe c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could...CVE-2017-1000381Fix available7.5 High
- openssl, nodejs node.js +1 moreBN_mod_exp may produce incorrect results on x86_64CVE-2017-3732Fix availableEPSS 15.4%5.9 Medium
- openssl, nodejs node.js +1 moreTruncated packet could crash via OOB readCVE-2017-3731Fix availableEPSS 57.3%7.5 High
- nodejs node.jsSymlink Arbitrary File Overwrite in tarCVE-2015-8860Fix available7.5 High
- nodejs node.jsRegular Expression Denial of Service in semverCVE-2015-8855Fix available7.5 High
- nodejs node.jsXSS Filter Bypass via Encoded URL in validatorCVE-2014-9772Fix available6.1 Medium
- nodejs node.jsMultiple XSS Filter Bypasses in validatorCVE-2013-7454Fix available6.1 Medium
- nodejs node.jsModerate severity vulnerability that affects validatorCVE-2013-7453Fix available6.1 Medium
- Show moreLoading…