Nodejs - vulnerabilities (CVEs)

289 CVEs in 5 products, 19 in the last 30 days, newest from 2026-10-23.

Products

• Node.js - 188 CVEs
• Node - 129 CVEs
• Undici - 53 CVEs
• Nodejs - 18 CVEs
• Elliptic - 1 CVEs

Newest CVEs of Nodejs

• CVE-2026-105481 - CVSS 6.5 (medium), 2026-10-23: A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is…
• CVE-2026-106069 - CVSS 7.4 (high), 2026-10-23: A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected…
• CVE-2026-106072 - CVSS 6.7 (medium), 2026-10-23: A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a…
• CVE-2026-105483 - CVSS 7.4 (high), 2026-10-23: A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the…
• CVE-2026-106071 - CVSS 3.6 (low), 2026-10-23: A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.…
• CVE-2026-106074 - CVSS 4.8 (medium), 2026-10-23: A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved…
• CVE-2026-105482 - CVSS 7.4 (high), 2026-10-23: A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an…
• CVE-2026-106070 - CVSS 3.7 (low), 2026-10-23: A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation…
• CVE-2026-106073 - CVSS 3.3 (low), 2026-10-23: A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of…
• CVE-2026-111497 - CVSS 9.8 (critical), 2026-10-22: A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote…
• CVE-2026-87029 - CVSS 7.5 (high), 2026-10-15: undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed…
• CVE-2026-109932 - CVSS 7.5 (high), 2026-10-15: undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client,…
• CVE-2026-87018 - CVSS 7.5 (high), 2026-10-15: undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes…
• CVE-2026-109383 - CVSS 9.1 (critical), 2026-10-15: undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes…
• CVE-2026-109829 - CVSS 9.1 (critical), 2026-10-15: undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and…
• CVE-2026-109841 - CVSS 7.5 (high), 2026-10-15: undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource…
• CVE-2026-109924 - CVSS 7.5 (high), 2026-10-15: undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be…
• CVE-2026-109869 - CVSS 7.5 (high), 2026-10-15: undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation…
• CVE-2026-109855 - CVSS 7.5 (high), 2026-10-15: undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is…
• CVE-2026-18149 - CVSS 5.9 (medium), 2026-09-04: undici's retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length,…
• CVE-2026-18540 - CVSS 3.7 (low), 2026-09-04: undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting…
• CVE-2026-19534 - CVSS 7.5 (high), 2026-09-04: undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never…
• CVE-2026-84890 - CVSS 5.9 (medium), 2026-09-04: undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers…
• CVE-2026-84933 - CVSS 8.2 (high), 2026-09-04: undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header.…
• CVE-2026-84947 - CVSS 5.3 (medium), 2026-09-04: undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the…
• CVE-2026-84961 - CVSS 9.1 (critical), 2026-09-04: undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON…
• CVE-2026-85008 - CVSS 5.3 (medium), 2026-09-04: undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from…
• CVE-2026-85152 - CVSS 7.4 (high), 2026-09-04: undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a…
• CVE-2026-85014 - CVSS 7.5 (high), 2026-09-04: undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close…
• CVE-2026-85024 - CVSS 5.9 (medium), 2026-09-04: undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error…