{"items":[{"id":"CVE-2019-5739","published":"2019-03-28T16:27:34.000Z","updated":"2024-08-04T20:01:52.297Z","title":"Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated…","severity":"HIGH","score":7.5,"vendor":"Node.js","product":"Node.js","kev":false,"epss":0.04929,"kevAdded":null},{"id":"CVE-2019-5737","published":"2019-03-28T16:20:28.000Z","updated":"2024-08-04T20:01:52.386Z","title":"In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by…","severity":"HIGH","score":7.5,"vendor":"Node.js","product":"Node.js","kev":false,"epss":0.16184,"kevAdded":null},{"id":"CVE-2018-12123","published":"2018-11-28T17:00:00.000Z","updated":"2026-10-08T21:14:00.915Z","title":"Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is…","severity":"MEDIUM","score":4.3,"vendor":"The Node.js Project","product":"Node.js","kev":false,"epss":0.04032,"kevAdded":null},{"id":"CVE-2018-12122","published":"2018-11-28T17:00:00.000Z","updated":"2026-10-08T21:14:00.666Z","title":"Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by…","severity":"HIGH","score":7.5,"vendor":"The Node.js Project","product":"Node.js","kev":false,"epss":0.41288,"kevAdded":null},{"id":"CVE-2018-12121","published":"2018-11-28T17:00:00.000Z","updated":"2026-10-08T21:13:51.822Z","title":"Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests…","severity":"HIGH","score":7.5,"vendor":"The Node.js Project","product":"Node.js","kev":false,"epss":0.10207,"kevAdded":null},{"id":"CVE-2018-12120","published":"2018-11-28T17:00:00.000Z","updated":"2026-10-08T21:14:01.067Z","title":"Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with `node --debug` or…","severity":"HIGH","score":8.1,"vendor":"The Node.js Project","product":"Node.js","kev":false,"epss":0.04277,"kevAdded":null},{"id":"CVE-2018-12116","published":"2018-11-28T17:00:00.000Z","updated":"2026-10-08T21:14:00.789Z","title":"Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for…","severity":"HIGH","score":7.5,"vendor":"The Node.js Project","product":"Node.js","kev":false,"epss":0.04612,"kevAdded":null},{"id":"CVE-2018-12115","published":"2018-08-21T13:00:00.000Z","updated":"2026-10-15T17:22:34.814Z","title":"In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`,…","severity":"HIGH","score":7.5,"vendor":"The Node.js Project","product":"Node.js","kev":false,"epss":0.07779,"kevAdded":null},{"id":"CVE-2018-7166","published":"2018-08-21T13:00:00.000Z","updated":"2026-10-08T21:14:05.567Z","title":"In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended…","severity":"HIGH","score":7.5,"vendor":"The Node.js Project","product":"Node.js","kev":false,"epss":0.03289,"kevAdded":null},{"id":"CVE-2018-7167","published":"2018-06-13T16:00:00.000Z","updated":"2026-10-08T21:14:04.882Z","title":"Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this…","severity":"HIGH","score":7.5,"vendor":"The Node.js Project","product":"Node.js","kev":false,"epss":0.06689,"kevAdded":null},{"id":"CVE-2018-7164","published":"2018-06-13T16:00:00.000Z","updated":"2026-10-08T21:14:05.436Z","title":"Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from…","severity":"HIGH","score":7.5,"vendor":"The Node.js Project","product":"Node.js","kev":false,"epss":0.06214,"kevAdded":null},{"id":"CVE-2018-7162","published":"2018-06-13T16:00:00.000Z","updated":"2026-10-08T21:14:04.752Z","title":"All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node process which…","severity":"HIGH","score":7.5,"vendor":"The Node.js Project","product":"Node.js","kev":false,"epss":0.06645,"kevAdded":null},{"id":"CVE-2018-7161","published":"2018-06-13T16:00:00.000Z","updated":"2026-10-08T21:14:04.606Z","title":"All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server…","severity":"HIGH","score":7.5,"vendor":"The Node.js Project","product":"Node.js","kev":false,"epss":0.07485,"kevAdded":null},{"id":"CVE-2018-7160","published":"2018-05-17T14:00:00.000Z","updated":"2026-10-08T21:14:05.004Z","title":"The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is…","severity":"HIGH","score":8.8,"vendor":"The Node.js Project","product":"Node.js","kev":false,"epss":0.09493,"kevAdded":null},{"id":"CVE-2018-7159","published":"2018-05-17T14:00:00.000Z","updated":"2026-10-08T21:13:54.303Z","title":"The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be…","severity":"MEDIUM","score":5.3,"vendor":"The Node.js Project","product":"Node.js","kev":false,"epss":0.03542,"kevAdded":null},{"id":"CVE-2018-7158","published":"2018-05-17T14:00:00.000Z","updated":"2026-10-08T21:14:05.296Z","title":"The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced…","severity":"HIGH","score":7.5,"vendor":"The Node.js Project","product":"Node.js","kev":false,"epss":0.03386,"kevAdded":null},{"id":"CVE-2017-15897","published":"2017-12-11T21:00:00.000Z","updated":"2024-09-17T03:42:59.193Z","title":"Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified.…","severity":"LOW","score":3.1,"vendor":"The Node.js Project","product":"Node.js","kev":false,"epss":0.02322,"kevAdded":null},{"id":"CVE-2017-15896","published":"2017-12-11T21:00:00.000Z","updated":"2024-09-16T19:50:49.572Z","title":"Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active…","severity":"CRITICAL","score":9.1,"vendor":"The Node.js Project","product":"Node.js","kev":false,"epss":0.02385,"kevAdded":null}]}