Skip to contentNodejs vulnerabilities
Newest
- nodejs undiciundici vulnerable to HTTP response queue poisoning via keep-alive socket reuseCVE-2026-6733Fix available3.7 Low
- nodejs undiciundici vulnerable to HTTP header injection via Set-Cookie percent-decodingCVE-2026-9679Fix available5.9 Medium
- nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 +25 more +27 moreundici WebSocket client vulnerable to denial of service via fragment count bypassCVE-2026-12151Fix available7.5 High
- andybalholm brotli, 7-zip p7zip, anthropic bun +100 more +102 moreOut-of-Bounds Write in Google Brotli DecoderCVE-2026-111497In KEVPublic exploitFix availableEPSS 82.6%9.2 Critical
- nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 +21 more +23 moreundici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgentCVE-2026-9697Fix available7.4 High
- nodejs undiciundici vulnerable to cross-user information disclosure via shared cache whitespace bypassCVE-2026-9678Fix available5.9 Medium
- nodejs undiciundici WebSocket client vulnerable to denial of service via cumulative fragment bypassCVE-2026-9675Fix available7.5 High
- nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 +19 more +21 moreundici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuseCVE-2026-6734Fix available7.5 High
- nodejs node, node.js +1 moreA flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket...CVE-2026-48936Fix available3.3 Low
- nodejs node, node.js +1 moreA flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was...CVE-2026-48935Fix available3.3 Low
- nodejs node, node.js +1 moreA flaw in Node.js TLS host verification can cause an attacker to bypass certification validation....CVE-2026-48934Fix available4.3 Medium
- nodejs node, node.js, red hat enterprise linux 10 +4 more +6 moreA flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt(...CVE-2026-48933Fix available7.5 High
- nodejs node, node.js +1 moreA flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent...CVE-2026-48930Fix available5.6 Medium
- nodejs node, node.js +1 moreA inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context...CVE-2026-48928Fix available4.2 Medium
- nodejs node, node.js +1 moreA flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames,...CVE-2026-48619Fix available5.3 Medium
- nodejs node, node.js, red hat enterprise linux 10 +4 more +6 moreA flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead...CVE-2026-48618Fix available7.7 High
- nodejs node, node.js +1 moreA flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL...CVE-2026-48615Fix available5.9 Medium
- nodejs node, node.js +1 moreA flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server...CVE-2026-21711Fix available5.3 Medium
- nodejs node, node.js, red hat enterprise linux 10 +7 more +9 moreA flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received...CVE-2026-21710Public exploitFix availableEPSS 25.4%7.5 High
- nodejs node, node.js +1 moreA flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user...CVE-2026-21713Fix available5.9 Medium
- nodejs node, node.js +1 moreA memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream...CVE-2026-21714Fix available5.3 Medium
- nodejs node, node.js +1 moreA flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()`...CVE-2026-21715Fix available3.3 Low
- nodejs node, node.js +1 moreAn incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the...CVE-2026-21716Fix available3.3 Low
- nodejs node, node.js +1 moreA flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric...CVE-2026-21717Public exploitFix available5.9 Medium
- nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 on rhel 9 +19 more +21 moreundici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits ValidationCVE-2026-2229Fix available7.5 High
- nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 on rhel 9 +18 more +20 moreundici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the clientCVE-2026-1528Fix available7.5 High
- nodejs undiciundici is vulnerable to CRLF Injection via upgrade optionCVE-2026-1527Fix available4.6 Medium
- nodejs undiciundici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoSCVE-2026-2581Fix available5.9 Medium
- nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 on rhel 9 +19 more +21 moreundici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate DecompressionCVE-2026-1526Fix available7.5 High
- nodejs undiciundici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')CVE-2026-1525Fix available6.5 Medium
- nodejs node, node.js +1 moreA flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass...CVE-2026-21636Public exploitFix available5.8 Medium
- nodejs node, node.js +1 moreA flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a...CVE-2026-21637Fix available5.9 Medium
- nodejs node, node.js +1 moreWe have identified a bug in Node.js error handling where "Maximum call stack size exceeded"...CVE-2025-59466Fix available5.9 Medium
- nodejs node, node.js, red hat enterprise linux 10 +6 more +8 moreA malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to...CVE-2025-59465Fix available7.5 High
- nodejs node, node.js +1 moreA flaw in Node.js's permission model allows a file's access and modification timestamps to be...CVE-2025-55132Fix available2.8 Low
- nodejs node, red hat enterprise linux 10, enterprise linux 10.0 extended update support +5 more +7 moreA flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are...CVE-2025-55131Fix available7.1 High
- nodejs node, node.js, red hat enterprise linux 10 +6 more +8 moreA flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow...CVE-2025-55130Public exploitFix available7.1 High
- nodejs undiciUndici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustionCVE-2026-22036Fix available5.9 Medium
- nodejs node, nodejs +1 moreAn incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting...CVE-2025-27210Public exploitFix availableEPSS 14.3%7.5 High
- nodejs nodeThe V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash...CVE-2025-27209Fix available7.5 High
- nodejs nodeA flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX`...CVE-2025-23167Public exploitFix available6.5 Medium
- nodejs nodeThe C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user...CVE-2025-23166Fix available7.5 High
- nodejs nodeIn Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in ...CVE-2025-23165Fix available3.7 Low
- nodejs undiciundici Denial of Service attack via bad certificate dataCVE-2025-47279Fix available3.1 Low
- nodejs node, node.js +1 moreA vulnerability has been identified in Node.js, specifically affecting the handling of drive...CVE-2025-23084Fix available5.6 Medium
- nodejs nodeA memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY...CVE-2025-23085Fix available5.3 Medium
- nodejs nodeWith the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker...CVE-2025-23083Fix available7.7 High
- nodejs undiciUndici Uses Insufficiently Random ValuesCVE-2025-22150Fix available6.8 Medium
- indutny ellipticValid ECDSA signatures erroneously rejected in EllipticCVE-2024-48948Fix available4.8 Medium
- nodejs nodeThe Permission Model assumes that any path starting with two backslashes \ has a four-character...CVE-2024-37372Fix available3.6 Low
- Show moreLoading…