from 0, < 14.15.5-r0
CRITICAL9.8CVE-2026-48930A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation… from 0, < 22.23.0-r0
CRITICAL9.8The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
from 0, < 16.20.2-r0
CRITICAL9.8nodejs - security update
from 0, < 12.22.4-r0
CRITICAL9.8Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validatio…
from 0, < 12.22.5-r0
CRITICAL9.8Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparis…
from 0, < 10.19.0-r0
CRITICAL9.8HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed
from 0, < 10.19.0-r0
CRITICAL9.8c-ares - security update
from 0, < 6.8.0-r0
CRITICAL9.1A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyG…
from 0, < 16.17.1-r0
CRITICAL9.1llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding
from 0, < 14.20.1-r0
CRITICAL9.1llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields
from 0, < 14.20.1-r0
CRITICAL9.1Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure.
from 0, < 8.9.3-r0
HIGH8.8The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition f…
from 0, < 16.20.2-r0
HIGH8.8The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution.
from 0, < 8.11.0-r0
HIGH8.8Google V8 before 5.2.361.32, as used in Google Chrome before 52.0.2743.82, does not properly process left-trimmed objects, which allows rem…
from 0, < 6.10.0-r0
HIGH8.6node-tar - security update
from 0, < 12.22.6-r0
HIGH8.2An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2…
from 0, < 18.20.1-r0
HIGH8.2Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "propertie…
from 0, < 12.22.10-r0
HIGH8.1Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via chil…
from 0, < 0
HIGH8.1nodejs - security update
from 0, < 18.12.1-r0
HIGH8.1nodejs - security update
from 0, < 0
HIGH8.1nodejs - security update
from 0, < 12.20.1-r0
HIGH8.1napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.
from 0, < 12.20.1-r0
HIGH7.8The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which…
from 0, < 12.20.1-r0
HIGH7.7With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created.
from 0, < 22.13.1-r0
HIGH7.5A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on…
from 0, < 22.23.0-r0
HIGH7.5A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages.
from 0, < 22.23.0-r0
HIGH7.5nodejs - security update
from 0, < 22.22.2-r0
HIGH7.5We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.cre…
from 0, < 22.22.2-r0
HIGH7.5The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background…
from 0, < 22.15.1-r0
HIGH7.5Resource exhaustion vulnerability in h2 may lead to Denial of Service (DoS)
from 0, < 10.16.3-r0
HIGH7.5When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation…
from 0, < 18.18.2-r0
HIGH7.5A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
from 0, < 16.20.2-r0
HIGH7.5A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL err…
from 0, < 16.19.1-r0
HIGH7.5nodejs - security update
from 0, < 14.21.3-r0
HIGH7.5Regular Expression Denial of Service in Headers
from 0, < 16.19.1-r0
HIGH7.5X.509 Email Address 4-byte Buffer Overflow
from 0, < 18.12.1-r0
HIGH7.5X.509 Email Address Variable Length Buffer Overflow
from 0, < 18.12.1-r0
HIGH7.5h2o - security update
from 0, < 10.16.3-r0
HIGH7.5Unexpected server crash in Next.js.
from 0, < 0
HIGH7.5Regular Expression Denial of Service (ReDoS)
from 0, < 14.16.1-r1
HIGH7.5Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”.
from 0, < 12.21.0-r0
HIGH7.5nodejs - security update
from 0, < 12.21.0-r0
HIGH7.5A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in vers…
from 0, < 12.20.1-r0
HIGH7.5Denial of service in nghttp2
from 0, < 12.20.1-r0
HIGH7.5nodejs - security update
from 0, < 10.19.0-r0
HIGH7.5Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service.
from 0, < 10.16.3-r0
HIGH7.5Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service.
from 0, < 10.16.3-r0
HIGH7.5Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service.
from 0, < 10.16.3-r0
HIGH7.5Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service.
from 0, < 10.16.3-r0
HIGH7.5nghttp2 - security update
from 0, < 10.16.3-r0
HIGH7.5In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of…
from 0, < 10.15.3-r0
HIGH7.5Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial…
from 0, < 10.14.0-r0
HIGH7.5Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combinatio…
from 0, < 10.14.0-r0
HIGH7.5Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provi…
from 0, < 8.14.0-r0
HIGH7.5In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`…
from 0, < 8.11.4-r0
HIGH7.5Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service.
from 0, < 8.11.3-r0
HIGH7.5All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH.
from 0, < 8.11.3-r0
HIGH7.5The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector.
from 0, < 8.11.0-r0
HIGH7.5nghttp2 - security update
from 0, < 8.11.3-r0
HIGH7.5Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (uncaught exception and…
from 0, < 6.11.5-r0
HIGH7.5c-ares - security update
from 0, < 6.11.1-r0
HIGH7.4Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in…
from 0, < 12.22.10-r0
HIGH7.4Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users.
from 0, < 12.20.1-r0
HIGH7.4TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.
from 0, < 12.20.1-r0
HIGH7.3Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be explo…
from 0, < 0
HIGH7.3Prototype Pollution in y18n
from 0, < 10.24.1-r0
MEDIUM6.8Use of Insufficiently Random Values in undici
from 0, < 22.13.1-r0
MEDIUM6.5A security flaw in Node.js allows a bypass of network import restrictions.
from 0, < 20.15.1-r0
MEDIUM6.5The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to…
from 0, < 18.20.1-r0
MEDIUM6.5The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF.
from 0, < 14.20.1-r0
MEDIUM6.5The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding he…
from 0, < 14.20.1-r0
MEDIUM6.5nodejs - security update
from 0, < 12.22.10-r0
MEDIUM6.5The parse function in llhttp < 2.1.4 and < 6.0.6.
from 0, < 12.22.10-r0
MEDIUM6.5http-parser - security update
from 0, < 12.20.1-r0
MEDIUM6.5Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service.
from 0, < 10.16.3-r0
MEDIUM5.9A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially p…
from 0, < 22.22.2-r0
MEDIUM5.9A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timin…
from 0, < 22.22.2-r0
MEDIUM5.9The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack.
from 0, < 10.14.0-r0
MEDIUM5.9openssl - security update
from 0, < 10.14.0-r0
MEDIUM5.7A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalize…
from 0, < 24.14.1-r0
MEDIUM5.6c-ares - security update
from 0, < 12.22.5-r0
MEDIUM5.5A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment.
from 0, < 22.13.1-r0
MEDIUM5.4A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups.
from 0, < 22.23.0-r0
MEDIUM5.3A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame.
from 0, < 22.23.0-r0
MEDIUM5.3A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow…
from 0, < 22.22.2-r0
MEDIUM5.3A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process…
from 0, < 22.22.2-r0
MEDIUM5.3nodejs - security update
from 0, < 22.13.1-r0
MEDIUM5.3Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code.
from 0, < 18.18.2-r0
MEDIUM5.3Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly.
from 0, < 12.22.10-r0
MEDIUM5.3Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format.
from 0, < 12.22.10-r0
MEDIUM5.3If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned a…
from 0, < 12.22.5-r0
MEDIUM5.3libuv1 - security update
from 0, < 12.22.2-r0
MEDIUM5.3The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1…
from 0, < 8.11.0-r0
MEDIUM4.6CRLF Injection in Nodejs ‘undici’ via host
from 0, < 16.19.1-r0
MEDIUM4.3A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.
from 0, < 22.23.0-r0
MEDIUM4.3Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a No…
from 0, < 10.14.0-r0
MEDIUM4.2nodejs - security update
from 0, < 14.21.3-r0
LOW3.9Undici's cookie header not cleared on cross-origin redirect in fetch
from 0, < 18.18.2-r0
LOW3.7In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocate…
from 0, < 22.15.1-r0