Skip to contentNodejs vulnerabilities
Newest
- nodejs node, nodejs +1 moreBypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with...CVE-2024-36138Fix available8.1 High
- nodejs nodeA vulnerability has been identified in Node.js, affecting users of the experimental permission...CVE-2024-36137Fix available3.3 Low
- node.js, nodejs node +1 moreA vulnerability has been identified in Node.js, affecting users of the experimental permission...CVE-2024-22018Fix available2.9 Low
- node.js, nodejs node, nodejs +2 moreA security flaw in Node.js allows a bypass of network import restrictions.
By embedding non...CVE-2024-22020Fix available6.5 Medium
- nodejs undiciUndici vulnerable to data leak when using response.arrayBuffer()CVE-2024-38372Fix available2.0 Low
- node.js, nodejs node +1 moreDue to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a...CVE-2024-27980Fix available8.1 High
- go programming language golang, haskell process library, haskell programming language haskel +6 more +8 moreCommand injection vulnerability in programing languages on Microsoft Windows operating system.CVE-2024-3566Fix available9.8 Critical
- nodejs node, node.js +1 moreThe team has identified a critical vulnerability in the http server of the most recent version of...CVE-2024-27982Fix available6.5 Medium
- nodejs undici, fedoraproject fedora +1 moreUndici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrectCVE-2024-30261Fix available2.6 Low
- nodejs undici, fedoraproject fedora +1 moreUndici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipelineCVE-2024-30260Fix available3.9 Low
- nodejs node, nodejs +1 moreAn attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount...CVE-2024-27983Public exploitFix availableEPSS 83.8%8.2 High
- nodejs undiciBackpressure request ignored in fetch() in UndiciCVE-2024-24750Fix available6.5 Medium
- nodejs undiciProxy-Authorization header not cleared on cross-origin redirect in fetch in UndiciCVE-2024-24758Fix available3.9 Low
- nodejs nodeA vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack...CVE-2024-22025Fix available6.5 Medium
- node.js, nodejs node +1 moreThe Node.js Permission Model does not clarify in the documentation that wildcards should be only...CVE-2024-21890Fix available5.0 Medium
- node.js, nodejs node, nodejs +2 moreNode.js depends on multiple built-in utility functions to normalize paths provided to node:fs...CVE-2024-21891Fix available7.9 High
- nodejs node, nodejs +1 moreNode.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked...CVE-2023-46809Fix available7.4 High
- node.js, nodejs node, nodejs +2 moresetuid() does not affect libuv's internal io_uring operations if initialized before the call to...CVE-2024-22017Public exploitFix available7.3 High
- node.js, nodejs node, nodejs +2 moreThe permission model protects itself against path traversal attacks by calling path.resolve() on...CVE-2024-21896Fix available7.9 High
- node.js, nodejs node, netapp astra control center +2 moreA vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP...CVE-2024-22019Fix available7.5 High
- node.js, nodejs node +1 moreOn Linux, Node.js ignores certain environment variables if those may have been set by an...CVE-2024-21892Fix available7.5 High
- nodejs node, node.js, fedoraproject fedora +2 moreVarious `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In...CVE-2023-39332Fix available9.8 Critical
- nodejs node, node.js +1 moreA previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit...CVE-2023-39331Fix available7.7 High
- nodejs node, nodejs +1 moreMaliciously crafted export names in an imported WebAssembly module can inject JavaScript code....CVE-2023-39333Fix available5.3 Medium
- nodejs node, node.js, fedoraproject fedora +2 moreWhen the Node.js policy feature checks the integrity of a resource against a trusted manifest,...CVE-2023-38552Fix available7.5 High
- nodejs undici, fedoraproject fedora +1 moreUndici's cookie header not cleared on cross-origin redirect in fetchCVE-2023-45143Fix available3.9 Low
- nodejs node, node.js +1 moreThe use of the deprecated API `process.binding()` can bypass the permission model through path...CVE-2023-32558Fix available7.5 High
- node.js, nodejs node +1 moreA vulnerability has been identified in Node.js version 20, affecting users of the experimental...CVE-2023-32005Fix available5.3 Medium
- node.js, nodejs node, fedoraproject fedora +2 more`fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a...CVE-2023-32003Fix available5.3 Medium
- node.js, nodejs node, fedoraproject fedora +2 moreA vulnerability has been discovered in Node.js version 20, specifically within the experimental...CVE-2023-32004Fix available8.8 High
- nodejs node, node.js, nodejs +2 moreA privilege escalation vulnerability exists in the experimental policy mechanism in all active...CVE-2023-32559Fix available7.5 High
- node.js, nodejs node, fedoraproject fedora +2 moreThe use of `module.constructor.createRequire()` can bypass the policy mechanism and require...CVE-2023-32006Fix available8.8 High
- node.js, nodejs node, nodejs +2 moreThe use of `Module._load()` can bypass the policy mechanism and require modules outside of the...CVE-2023-32002Fix available9.8 Critical
- eclipse jetty, ietf http, http/2 +166 more +168 moreEclipse Jetty XmlParser allows arbitrary DOCTYPE declarationsCVE-2023-44487In KEVPublic exploitFix availableEPSS 100.0%7.5 High
- node.js, nodejs node, nodejs +2 moreA vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental...CVE-2023-30587Fix available7.5 High
- node.js, nodejs node, nodejs +2 moreA vulnerability has been discovered in Node.js version 20, specifically within the experimental...CVE-2023-30584Fix available7.7 High
- node.js, nodejs node, nodejs +2 morefs.openAsBlob() can bypass the experimental permission model when using the file system read...CVE-2023-30583Fix available7.5 High
- node.js, nodejs node, nodejs +2 moreA vulnerability has been identified in Node.js version 20, affecting users of the experimental...CVE-2023-30582Fix available5.3 Medium
- nodejs node, node.js +1 moreA privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL...CVE-2023-30586Fix available7.5 High
- nodejs node, node.js +1 moreThe generateKeys() API function returned from crypto.createDiffieHellman() only generates missing...CVE-2023-30590Fix available7.5 High
- nodejs node, node.js, fedoraproject fedora +2 morellhttp vulnerable to HTTP request smugglingCVE-2023-30589Fix available7.5 High
- nodejs node, node.js +1 moreWhen an invalid public key is used to create an x509 certificate using the crypto.X509Certificate...CVE-2023-30588Fix available5.3 Medium
- nodejs node, node.js +1 moreA vulnerability has been identified in the Node.js (.msi version) installation process,...CVE-2023-30585Fix available7.5 High
- nodejs node, node.js +1 moreThe use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism...CVE-2023-30581Fix available7.5 High
- dogecoin node, dogecoin +1 moreRab13s ExploitCVE-2023-307699.1 Critical
- nodejs node, node.js, debian linux +2 moreAn untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21...CVE-2023-23920Fix available4.2 Medium
- nodejs node, node.js +1 moreA cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in...CVE-2023-23919Fix available7.5 High
- nodejs node, node.js +1 moreA privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3...CVE-2023-23918Fix available7.5 High
- nodejs node.js, undici +1 moreCRLF Injection in Nodejs ‘undici’ via hostCVE-2023-23936Fix available6.5 Medium
- nodejs undiciUndici vulnerable to Regular Expression Denial of Service in HeadersCVE-2023-24807Fix available7.5 High
- Show moreLoading…