Node.js - vulnerabilities (CVEs)
6 CVEs in 3 products, 0 in the last 30 days, newest from 2024-04-10.
Products
Newest CVEs of Node.js
- CVE-2024-3566 - CVSS 9.8 (critical), 2024-04-10: A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function…
- CVE-2024-22019 - CVSS 7.5 (high), 2024-02-20: A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and…
- CVE-2019-5737 - CVSS 7.5 (high), 2019-03-28: In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by…
- CVE-2019-5739 - CVSS 7.5 (high), 2019-03-28: Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated…
- CVE-2018-1002204 - CVSS 5.5 (medium), 2018-07-25: adm-zip npm library before 0.4.9 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip…
- CVE-2018-1002203 - CVSS 5.5 (medium), 2018-07-25: unzipper npm library before 0.8.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip…
