NodeJS Node
129 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-106074 | 22.23.3 ; 24.22.0 ; 26.12.0 | A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt( | MEDIUM 4.8 | 0.3 % | ||
| CVE-2026-106073 | 22.23.3 ; 24.22.0 ; 26.12.0 | A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an | LOW 3.3 | 0.2 % | ||
| CVE-2026-106072 | 22.23.3 ; 24.22.0 ; 26.12.0 | A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects | MEDIUM 6.7 | 0.5 % | ||
| CVE-2026-106071 | 26.12.0 | A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--all | LOW 3.6 | 0.2 % | ||
| CVE-2026-106070 | 26.12.0 | A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central | LOW 3.7 | 0.3 % | ||
| CVE-2026-106069 | 22.23.3 ; 24.22.0 ; 26.12.0 | A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the c | HIGH 7.4 | 0.3 % | ||
| CVE-2026-105483 | 24.22.0 ; 26.12.0 | A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 a | HIGH 7.4 | 0.3 % | ||
| CVE-2026-105482 | 22.23.3 ; 24.22.0 ; 26.12.0 | A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.rev | HIGH 7.4 | 0.4 % | ||
| CVE-2026-105481 | 22.23.3 ; 24.22.0 ; 26.12.0 | A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-48932 | 22.22.3 ; 24.16.0 ; 26.3.0 | A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from | LOW 3.7 | 0.3 % | ||
| CVE-2026-56848 | 26.5.0 ; 24.18.0 ; 22.23.1 | A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is execut | HIGH 7.5 | 0.5 % | ||
| CVE-2026-58045 | 26.5.0 ; 24.18.0 ; 22.23.1 | A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing t | MEDIUM 6.2 | 0.2 % | ||
| CVE-2026-58044 | 26.5.0 ; 24.18.0 ; 22.23.1 | A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from | LOW 3.7 | 0.3 % | ||
| CVE-2026-58042 | 26.5.0 ; 24.18.0 ; 22.23.1 | A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated tr | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-58041 | 22.23.1 ; 24.18.0 ; 26.5.0 | A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cac | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-56846 | 24.18.0 ; 22.23.1 | A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. Thi | HIGH 7.5 | 0.5 % | ||
| CVE-2026-58039 | 26.5.0 ; 24.18.0 ; 22.23.1 | A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can | LOW 3.3 | 0.2 % | ||
| CVE-2026-58043 | 22.23.1 ; 24.18.0 ; 26.5.0 | A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission` | HIGH 8.4 | 0.1 % | ||
| CVE-2026-56850 | 26.5.0 ; 24.18.0 ; 22.23.1 | A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be | MEDIUM 4.4 | 0.1 % | ||
| CVE-2026-56847 | 26.5.0 ; 24.18.0 ; 22.23.1 | A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-58040 | 22.23.1 ; 24.18.0 ; 26.5.0 | An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomp | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-48930 | 22.22.3 ; 24.16.0 ; 26.3.0 | A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation i | CRITICAL 9.8 | 0.3 % | ||
| CVE-2026-48936 | 26.3.0 | A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permissio | LOW 3.3 | 0.1 % | ||
| CVE-2026-48935 | 22.22.3 ; 24.16.0 ; 26.3.0 | A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-rea | LOW 3.3 | 0.2 % | ||
| CVE-2026-48934 | 22.22.3 ; 24.16.0 ; 26.3.0 | A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supporte | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-48933 | 22.22.3 ; 24.16.0 ; 26.3.0 | A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerabi | HIGH 7.5 | 3.7 % | ||
| CVE-2026-48928 | 22.22.3 ; 24.16.0 ; 26.3.0 | A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-48619 | 22.22.3 ; 24.16.0 ; 26.3.0 | A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on | HIGH 7.5 | 0.6 % | ||
| CVE-2026-48618 | 22.22.3 ; 24.16.0 ; 26.3.0 | A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypas | HIGH 7.7 | 3.1 % | ||
| CVE-2026-48615 | 22.22.3 ; 24.16.0 ; 26.3.0 | A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials | HIGH 7.5 | 0.4 % | ||
| CVE-2026-48931 | 22.22.3 ; 24.16.0 ; 26.3.0 | A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This v | LOW 3.7 | 0.3 % | ||
| CVE-2026-48937 | 22.22.3 ; 24.16.0 | A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects | HIGH 7.5 | 0.6 % | ||
| CVE-2026-48617 | 22.22.3 ; 24.16.0 ; 26.3.0 | A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confide | HIGH 8.2 | 0.3 % | ||
| CVE-2026-21717 | 20.20.1 ; 22.22.1 ; 24.14.0 ; … | A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially pr | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-21716 | 20.20.1 ; 22.22.1 ; 24.14.0 ; … | An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permissio | LOW 3.3 | 0.1 % | ||
| CVE-2026-21715 | 20.20.1 ; 22.22.1 ; 24.14.0 ; … | A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, whi | LOW 3.3 | 0.1 % | ||
| CVE-2026-21714 | 20.20.1 ; 22.22.1 ; 24.14.0 ; … | A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow c | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-21713 | 20.20.1 ; 22.22.1 ; 24.14.0 ; … | A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-21711 | 25.8.1 ; 4.0 – < 4.* ; 5.0 – < 5.* ; … | A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission che | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-21710 | 20.20.1 ; 22.22.1 ; 24.14.0 ; … | A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the ap | HIGH 7.5 | 25 % | ||
| CVE-2026-21712 | 24.14.0 ; 25.8.1 | A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-21637 | 20.19.6 ; 22.21.1 ; 24.12.0 ; … | A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallba | HIGH 7.5 | 1.1 % | ||
| CVE-2026-21636 | 25.2.1 | A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabl | CRITICAL 10.0 | 0.9 % | ||
| CVE-2025-59466 | 20.19.6 ; 22.21.1 ; 24.12.0 ; … | We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.crea | HIGH 7.5 | 0.7 % | ||
| CVE-2025-59465 | 20.19.6 ; 22.21.1 ; 24.12.0 ; … | A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` er | HIGH 7.5 | 4.0 % | ||
| CVE-2025-59464 | 24.12.0 – < 24.12.0 | A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buff | HIGH 7.5 | 0.3 % | ||
| CVE-2025-55132 | 20.19.6 ; 22.21.1 ; 24.12.0 ; … | A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process | MEDIUM 5.3 | 0.3 % | ||
| CVE-2025-55131 | 20.19.6 ; 22.21.1 ; 24.12.0 ; … | A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module wit | HIGH 7.1 | 3.5 % | ||
| CVE-2025-55130 | 20.19.6 ; 22.21.1 ; 24.12.0 ; … | A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relativ | CRITICAL 9.1 | 1.7 % | ||
| CVE-2025-27210 | 20.0.0 – < 20.19.4 ; 22.0.0 – < 22.17.1 ; 24.0.0 – < 24.4.1 | An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. | HIGH 7.5 | 14 % | ||
| CVE-2025-27209 | 24.0.0 – < 24.4.1 | The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. This implementation re-introduces the Has | HIGH 7.5 | 1.3 % | ||
| CVE-2025-23167 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`. This in | MEDIUM 6.5 | 0.5 % | ||
| CVE-2025-23166 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background t | HIGH 7.5 | 0.8 % | ||
| CVE-2025-23165 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated | LOW 3.7 | 0.6 % | ||
| CVE-2025-23085 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid h | MEDIUM 5.3 | 1.4 % | ||
| CVE-2025-23084 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node. | MEDIUM 5.6 | 1.6 % | ||
| CVE-2025-23083 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only t | HIGH 7.7 | 0.4 % | ||
| CVE-2024-37372 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not alw | LOW 3.6 | 0.5 % | ||
| CVE-2024-27980 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject a | HIGH 8.1 | 1.4 % | ||
| CVE-2023-46809 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are | HIGH 7.4 | 1.3 % | ||
| CVE-2024-36138 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child | HIGH 8.1 | 1.1 % | ||
| CVE-2023-39333 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data | MEDIUM 5.3 | 1.1 % | ||
| CVE-2024-36137 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. | LOW 3.3 | 0.4 % | ||
| CVE-2023-30587 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspect | HIGH 7.5 | 0.7 % | ||
| CVE-2023-30584 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to impro | HIGH 7.7 | 0.3 % | ||
| CVE-2023-30583 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the `--allow-fs-read` flag in | HIGH 7.5 | 0.7 % | ||
| CVE-2023-30582 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read fla | MEDIUM 5.3 | 0.6 % | ||
| CVE-2024-22018 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. | LOW 2.9 | 0.5 % | ||
| CVE-2024-22020 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can e | MEDIUM 6.5 | 1.1 % | ||
| CVE-2024-27982 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to | MEDIUM 6.5 | 1.2 % | ||
| CVE-2024-27983 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 f | HIGH 8.2 | 87 % | ||
| CVE-2024-22025 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fet | MEDIUM 6.5 | 1.3 % | ||
| CVE-2024-22017 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform | HIGH 7.3 | 0.9 % | ||
| CVE-2024-22019 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resour | HIGH 7.5 | 3.2 % | ||
| CVE-2024-21896 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is | CRITICAL 9.8 | 1.3 % | ||
| CVE-2024-21892 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with | HIGH 7.8 | 0.6 % | ||
| CVE-2024-21891 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-d | HIGH 8.8 | 1.2 % | ||
| CVE-2024-21890 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. | MEDIUM 6.5 | 0.9 % | ||
| CVE-2023-30590 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only gener | HIGH 7.5 | 1.5 % | ||
| CVE-2023-30588 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs maki | MEDIUM 5.3 | 1.2 % | ||
| CVE-2023-30585 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install Nod | HIGH 7.5 | 1.5 % | ||
| CVE-2023-30581 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.jso | HIGH 7.5 | 1.1 % | ||
| CVE-2023-39332 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class ex | CRITICAL 9.8 | 2.2 % | ||
| CVE-2023-39331 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability ari | HIGH 7.7 | 1.5 % | ||
| CVE-2023-38552 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation a | HIGH 7.5 | 1.2 % | ||
| CVE-2023-32558 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all u | HIGH 7.5 | 1.7 % | ||
| CVE-2023-32005 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read fla | MEDIUM 5.3 | 1.4 % | ||
| CVE-2023-32559 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use | HIGH 7.5 | 1.8 % | ||
| CVE-2023-32002 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. T | CRITICAL 9.8 | 1.6 % | ||
| CVE-2023-32003 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | `fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack. This flaw arises from | MEDIUM 5.3 | 1.2 % | ||
| CVE-2023-32004 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to impro | HIGH 8.8 | 2.1 % | ||
| CVE-2023-32006 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition fo | HIGH 8.8 | 1.5 % | ||
| CVE-2023-30586 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission mo | HIGH 7.5 | 1.3 % | ||
| CVE-2023-30589 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP | HIGH 7.5 | 3.9 % | ||
| CVE-2023-23920 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search a | MEDIUM 4.2 | 0.5 % | ||
| CVE-2023-23919 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL erro | HIGH 7.5 | 2.2 % | ||
| CVE-2023-23918 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experime | HIGH 7.5 | 2.0 % | ||
| CVE-2022-43548 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost c | HIGH 8.1 | 15 % | ||
| CVE-2022-35256 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may res | MEDIUM 6.5 | 2.8 % | ||
| CVE-2022-35255 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGe | CRITICAL 9.1 | 2.1 % | ||
| CVE-2022-32223 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploi | HIGH 7.3 | 1.8 % | ||
| CVE-2022-32222 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf t | MEDIUM 5.3 | 2.2 % | ||
| CVE-2022-32215 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding hea | MEDIUM 6.5 | 70 % | ||
| CVE-2022-32214 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP re | MEDIUM 6.5 | 82 % | ||
| CVE-2022-32213 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding he | MEDIUM 6.5 | 45 % | ||
| CVE-2022-32212 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that | HIGH 8.1 | 6.4 % | ||
| CVE-2021-44533 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could cra | MEDIUM 5.3 | 9.4 % | ||
| CVE-2021-44532 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to c | MEDIUM 5.3 | 10 % | ||
| CVE-2021-44531 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in b | HIGH 7.4 | 8.4 % | ||
| CVE-2022-21824 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties | HIGH 8.2 | 22 % | ||
| CVE-2021-22959 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) | MEDIUM 6.5 | 3.2 % | ||
| CVE-2021-22960 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Req | MEDIUM 6.5 | 2.5 % | ||
| CVE-2021-22930 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory c | CRITICAL 9.8 | 36 % | ||
| CVE-2021-22940 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory c | HIGH 7.5 | 14 % | ||
| CVE-2021-22939 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned an | MEDIUM 5.3 | 15 % | ||
| CVE-2021-22931 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation | CRITICAL 9.8 | 22 % | ||
| CVE-2021-22921 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platform | HIGH 7.8 | 7.4 % | ||
| CVE-2021-22918 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. | MEDIUM 5.3 | 23 % | ||
| CVE-2021-22883 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an | HIGH 7.5 | 77 % | ||
| CVE-2021-22884 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “l | HIGH 7.5 | 37 % | ||
| CVE-2020-8265 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to | HIGH 8.1 | 9.1 % | ||
| CVE-2020-8287 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-E | MEDIUM 6.5 | 16 % | ||
| CVE-2020-8277 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versi | HIGH 7.5 | 54 % | ||
| CVE-2020-8201 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payl | HIGH 7.4 | 5.3 % | ||
| CVE-2020-8252 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which | HIGH 7.8 | 0.7 % | ||
| CVE-2020-8251 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unabl | HIGH 7.5 | 8.4 % | ||
| CVE-2019-15606 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value compariso | CRITICAL 9.8 | 20 % | ||
| CVE-2019-15604 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate | HIGH 7.5 | 20 % | ||
| CVE-2019-15605 | 4.0 – < 4.* ; 5.0 – < 5.* ; 6.0 – < 6.* ; … | HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed | CRITICAL 9.8 | 57 % |