Node.js (Nodejs) - vulnerabilities (CVEs)

188 CVEs, 1 in the last 30 days, 1723 known versions, newest CVE from 2026-10-22. Vendor: Nodejs.

CVEs of Node.js

CVE-2026-111497 - CVSS 9.8 (critical), 2026-10-22: A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote…
CVE-2026-56850 - CVSS 4.4 (medium), 2026-07-30: A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across…
CVE-2026-56847 - CVSS 6.1 (medium), 2026-07-30: A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to…
CVE-2026-58043 - CVSS 8.4 (high), 2026-07-30: A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is…
CVE-2026-48930 - CVSS 9.8 (critical), 2026-06-26: A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver…
CVE-2026-48935 - CVSS 3.3 (low), 2026-06-26: A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`. This…
CVE-2026-48615 - CVSS 7.5 (high), 2026-06-26: A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the…
CVE-2026-48928 - CVSS 5.4 (medium), 2026-06-26: A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release…
CVE-2026-48934 - CVSS 4.3 (medium), 2026-06-26: A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines:…
CVE-2026-48619 - CVSS 7.5 (high), 2026-06-26: A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client. This…
CVE-2026-48933 - CVSS 7.5 (high), 2026-06-26: A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all…
CVE-2026-48936 - CVSS 3.3 (low), 2026-06-26: A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission. This…
CVE-2026-48618 - CVSS 7.7 (high), 2026-06-26: A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver…
CVE-2026-48931 - CVSS 3.7 (low), 2026-06-22: A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects…
CVE-2026-48937 - CVSS 7.5 (high), 2026-06-18: A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supported…
CVE-2026-48617 - CVSS 8.2 (high), 2026-06-18: A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or…
CVE-2026-21717 - CVSS 5.9 (medium), 2026-03-30: A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By…
CVE-2026-21711 - CVSS 5.3 (medium), 2026-03-30: A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all…
CVE-2026-21715 - CVSS 3.3 (low), 2026-03-30: A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable…
CVE-2026-21714 - CVSS 5.3 (medium), 2026-03-30: A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to…
CVE-2026-21713 - CVSS 5.9 (medium), 2026-03-30: A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information…
CVE-2026-21716 - CVSS 3.3 (low), 2026-03-30: An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while…
CVE-2026-21710 - CVSS 7.5 (high), 2026-03-30: A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses…
CVE-2026-21712 - CVSS 6.5 (medium), 2026-03-30: A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN)…
CVE-2026-21636 - CVSS 10 (critical), 2026-01-20: A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without…
CVE-2026-21637 - CVSS 7.5 (high), 2026-01-20: A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use.…
CVE-2025-59466 - CVSS 7.5 (high), 2026-01-20: We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is…
CVE-2025-59465 - CVSS 7.5 (high), 2026-01-20: A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`.…
CVE-2025-59464 - CVSS 7.5 (high), 2026-01-20: A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When…
CVE-2025-55132 - CVSS 5.3 (medium), 2026-01-20: A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read…
CVE-2025-55130 - CVSS 9.1 (critical), 2026-01-20: A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths.…
CVE-2025-23084 - CVSS 5.6 (medium), 2025-01-28: A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do…
CVE-2024-27982 - CVSS 6.5 (medium), 2024-05-07: The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request…
CVE-2024-3566 - CVSS 9.8 (critical), 2024-04-10: A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function…
CVE-2024-21891 - CVSS 8.8 (high), 2024-02-20: Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined…
CVE-2024-22019 - CVSS 7.5 (high), 2024-02-20: A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and…
CVE-2024-21890 - CVSS 6.5 (medium), 2024-02-20: The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example: ```…
CVE-2024-21896 - CVSS 9.8 (critical), 2024-02-20: The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as…
CVE-2024-21892 - CVSS 7.8 (high), 2024-02-20: On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated…
CVE-2023-30590 - CVSS 7.5 (high), 2023-11-28: The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key…
CVE-2023-30588 - CVSS 5.3 (medium), 2023-11-28: When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible…
CVE-2023-30585 - CVSS 7.5 (high), 2023-11-28: A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install Node.js using the…
CVE-2023-30581 - CVSS 7.5 (high), 2023-11-23: The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This…
CVE-2023-39331 - CVSS 7.7 (high), 2023-10-18: A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the…
CVE-2023-38552 - CVSS 7.5 (high), 2023-10-18: When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged…
CVE-2023-39332 - CVSS 9.8 (critical), 2023-10-18: Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the…
CVE-2023-44487 - CVSS 7.5 (high), 2023-10-10: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the…
CVE-2023-32558 - CVSS 7.5 (high), 2023-09-12: The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all users using the…
CVE-2023-32005 - CVSS 5.3 (medium), 2023-09-12: A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a…
CVE-2023-32559 - CVSS 7.5 (high), 2023-08-24: A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated…
CVE-2023-32002 - CVSS 9.8 (critical), 2023-08-21: The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability…
CVE-2023-32006 - CVSS 8.8 (high), 2023-08-15: The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.…
CVE-2023-32004 - CVSS 8.8 (high), 2023-08-15: A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of…
CVE-2023-32003 - CVSS 5.3 (medium), 2023-08-15: `fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack. This flaw arises from a missing check in…
CVE-2023-30589 - CVSS 7.5 (high), 2023-07-01: The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling…
CVE-2023-30586 - CVSS 7.5 (high), 2023-07-01: A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled,…
CVE-2023-23920 - CVSS 4.2 (medium), 2023-02-23: An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially…
CVE-2023-23919 - CVSS 7.5 (high), 2023-02-23: A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after…
CVE-2023-23918 - CVSS 7.5 (high), 2023-02-23: A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions…
CVE-2023-23936 - CVSS 6.5 (medium), 2023-02-16: Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from…
CVE-2022-43548 - CVSS 8.1 (high), 2022-12-05: A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can…
CVE-2022-35256 - CVSS 6.5 (medium), 2022-12-05: The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP…
CVE-2022-35255 - CVSS 9.1 (critical), 2022-12-05: A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in…
CVE-2022-3786 - CVSS 7.5 (high), 2022-11-01: A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain…
CVE-2022-3602 - CVSS 7.5 (high), 2022-11-01: A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain…
CVE-2022-32213 - CVSS 6.5 (medium), 2022-07-14: The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead…
CVE-2022-32222 - CVSS 5.3 (medium), 2022-07-14: A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be…
CVE-2022-32212 - CVSS 8.1 (high), 2022-07-14: A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be…
CVE-2022-32215 - CVSS 6.5 (medium), 2022-07-14: The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can…
CVE-2022-32214 - CVSS 6.5 (medium), 2022-07-14: The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can…
CVE-2022-32223 - CVSS 7.3 (high), 2022-07-14: Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim…
CVE-2022-0778 - CVSS 7.5 (high), 2022-03-15: The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this…
CVE-2022-21824 - CVSS 8.2 (high), 2022-02-24: Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while…
CVE-2021-44533 - CVSS 5.3 (medium), 2022-02-24: Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate…
CVE-2021-44532 - CVSS 5.3 (medium), 2022-02-24: Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer…
CVE-2021-44531 - CVSS 7.4 (high), 2022-02-24: Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing…
CVE-2021-4044 - CVSS 7.5 (high), 2021-12-14: Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may return a negative…
CVE-2021-3672 - CVSS 5.6 (medium), 2021-11-23: A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong…
CVE-2021-22930 - CVSS 9.8 (critical), 2021-10-07: Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to…
CVE-2021-22940 - CVSS 7.5 (high), 2021-08-16: Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to…
CVE-2021-22939 - CVSS 5.3 (medium), 2021-08-16: If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to…
CVE-2021-22931 - CVSS 9.8 (critical), 2021-08-16: Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names…
CVE-2021-22921 - CVSS 7.8 (high), 2021-07-12: Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More…
CVE-2021-22918 - CVSS 5.3 (medium), 2021-07-12: Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is…
CVE-2021-3449 - CVSS 5.9 (medium), 2021-03-25: An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits…
CVE-2021-3450 - CVSS 7.4 (high), 2021-03-25: The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting…
CVE-2021-22884 - CVSS 7.5 (high), 2021-03-03: Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not…
CVE-2021-22883 - CVSS 7.5 (high), 2021-03-03: Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol'…
CVE-2021-23840 - CVSS 7.5 (high), 2021-02-16: Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to…
CVE-2020-8287 - CVSS 6.5 (medium), 2021-01-06: Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header…
CVE-2020-8265 - CVSS 8.1 (high), 2021-01-06: Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled…
CVE-2020-1971 - CVSS 5.9 (medium), 2020-12-08: The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a…
CVE-2018-21270 - CVSS 6.5 (medium), 2020-12-03: Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a…
CVE-2020-8277 - CVSS 7.5 (high), 2020-11-19: A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, <…
CVE-2020-8251 - CVSS 7.5 (high), 2020-09-18: Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new…
CVE-2020-8252 - CVSS 7.8 (high), 2020-09-18: The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a…
CVE-2020-8201 - CVSS 7.4 (high), 2020-09-18: Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be…
CVE-2020-8174 - CVSS 8.1 (high), 2020-07-24: napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.
CVE-2020-8172 - CVSS 7.4 (high), 2020-06-08: TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.
CVE-2020-11080 - CVSS 7.5 (high), 2020-06-03: In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious…

Home

Home