{"items":[{"id":"CVE-2026-106069","published":"2026-10-23T16:15:05.850Z","updated":"2026-11-02T13:31:52.012Z","title":"A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to,…","severity":"HIGH","score":7.4,"vendor":"nodejs","product":"node","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-105481","published":"2026-10-23T16:15:05.837Z","updated":"2026-11-02T15:54:45.159Z","title":"A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an…","severity":"MEDIUM","score":6.5,"vendor":"nodejs","product":"node","kev":false,"epss":0.00318,"kevAdded":null},{"id":"CVE-2026-105482","published":"2026-10-23T16:15:05.831Z","updated":"2026-11-02T15:51:54.058Z","title":"A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an…","severity":"HIGH","score":7.4,"vendor":"nodejs","product":"node","kev":false,"epss":0.00468,"kevAdded":null},{"id":"CVE-2026-106074","published":"2026-10-23T16:15:05.829Z","updated":"2026-11-02T15:48:44.599Z","title":"A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into…","severity":"MEDIUM","score":4.8,"vendor":"nodejs","product":"node","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2026-106071","published":"2026-10-23T16:15:05.791Z","updated":"2026-11-02T15:40:27.184Z","title":"A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.…","severity":"LOW","score":3.6,"vendor":"nodejs","product":"node","kev":false,"epss":0.00199,"kevAdded":null},{"id":"CVE-2026-106072","published":"2026-10-23T16:15:05.783Z","updated":"2026-11-02T15:39:59.537Z","title":"A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a…","severity":"MEDIUM","score":6.7,"vendor":"nodejs","product":"node","kev":false,"epss":0.00617,"kevAdded":null},{"id":"CVE-2026-105483","published":"2026-10-23T16:15:05.773Z","updated":"2026-11-02T15:37:11.172Z","title":"A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the…","severity":"HIGH","score":7.4,"vendor":"nodejs","product":"node","kev":false,"epss":0.00304,"kevAdded":null},{"id":"CVE-2026-106070","published":"2026-10-23T16:15:05.741Z","updated":"2026-11-02T15:33:58.070Z","title":"A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation…","severity":"LOW","score":3.7,"vendor":"nodejs","product":"node","kev":false,"epss":0.00367,"kevAdded":null},{"id":"CVE-2026-106073","published":"2026-10-23T16:15:05.728Z","updated":"2026-11-02T15:31:53.217Z","title":"A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of…","severity":"LOW","score":3.3,"vendor":"nodejs","product":"node","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-48932","published":"2026-09-01T02:08:29.536Z","updated":"2026-09-01T14:48:23.428Z","title":"A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible…","severity":"LOW","score":3.7,"vendor":"nodejs","product":"node","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2026-56848","published":"2026-08-04T15:57:24.399Z","updated":"2026-08-04T17:36:14.044Z","title":"A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a…","severity":"HIGH","score":7.5,"vendor":"nodejs","product":"node","kev":false,"epss":0.00521,"kevAdded":null},{"id":"CVE-2026-58042","published":"2026-08-04T00:49:58.362Z","updated":"2026-08-04T15:03:30.449Z","title":"A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this…","severity":"MEDIUM","score":5.9,"vendor":"nodejs","product":"node","kev":false,"epss":0.00369,"kevAdded":null},{"id":"CVE-2026-56846","published":"2026-08-04T00:49:58.319Z","updated":"2026-08-04T15:03:38.709Z","title":"A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability…","severity":"HIGH","score":7.5,"vendor":"nodejs","product":"node","kev":false,"epss":0.005,"kevAdded":null},{"id":"CVE-2026-58044","published":"2026-08-04T00:49:58.297Z","updated":"2026-08-04T15:03:46.089Z","title":"A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible…","severity":"LOW","score":3.7,"vendor":"nodejs","product":"node","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2026-58045","published":"2026-08-04T00:49:58.266Z","updated":"2026-08-04T15:03:57.326Z","title":"A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process…","severity":"MEDIUM","score":6.2,"vendor":"nodejs","product":"node","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-58041","published":"2026-08-04T00:49:58.112Z","updated":"2026-08-04T15:04:06.975Z","title":"A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared…","severity":"MEDIUM","score":5.3,"vendor":"nodejs","product":"node","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2026-58039","published":"2026-07-31T00:18:49.050Z","updated":"2026-07-31T16:01:49.630Z","title":"A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to…","severity":"LOW","score":3.3,"vendor":"nodejs","product":"node","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-56847","published":"2026-07-30T06:02:50.099Z","updated":"2026-07-30T12:35:31.331Z","title":"A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to…","severity":"LOW","score":3.3,"vendor":"nodejs","product":"node","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2026-58043","published":"2026-07-30T06:02:50.095Z","updated":"2026-07-31T03:55:48.673Z","title":"A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is…","severity":"HIGH","score":7.5,"vendor":"nodejs","product":"node","kev":false,"epss":0.00138,"kevAdded":null},{"id":"CVE-2026-56850","published":"2026-07-30T06:02:50.074Z","updated":"2026-07-30T12:37:10.100Z","title":"A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across…","severity":"MEDIUM","score":4.1,"vendor":"nodejs","product":"node","kev":false,"epss":0.00084,"kevAdded":null},{"id":"CVE-2026-58040","published":"2026-07-30T06:02:49.942Z","updated":"2026-07-30T12:50:20.213Z","title":"An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of…","severity":"MEDIUM","score":6.3,"vendor":"nodejs","product":"node","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2026-48930","published":"2026-06-26T01:14:37.006Z","updated":"2026-06-26T13:37:46.190Z","title":"A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver…","severity":"MEDIUM","score":5.6,"vendor":"nodejs","product":"node","kev":false,"epss":0.00315,"kevAdded":null},{"id":"CVE-2026-48928","published":"2026-06-26T01:14:36.981Z","updated":"2026-06-26T13:36:28.487Z","title":"A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release…","severity":"MEDIUM","score":4.2,"vendor":"nodejs","product":"node","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-48934","published":"2026-06-26T01:14:36.894Z","updated":"2026-06-29T12:40:27.051Z","title":"A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines:…","severity":"MEDIUM","score":4.3,"vendor":"nodejs","product":"node","kev":false,"epss":0.00258,"kevAdded":null},{"id":"CVE-2026-48936","published":"2026-06-26T01:14:36.878Z","updated":"2026-06-26T13:35:27.884Z","title":"A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission. This…","severity":"LOW","score":3.3,"vendor":"nodejs","product":"node","kev":false,"epss":0.00135,"kevAdded":null},{"id":"CVE-2026-48618","published":"2026-06-26T01:14:36.868Z","updated":"2026-08-10T12:05:43.364Z","title":"A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver…","severity":"HIGH","score":7.7,"vendor":"nodejs","product":"node","kev":false,"epss":0.03139,"kevAdded":null},{"id":"CVE-2026-48933","published":"2026-06-26T01:14:36.823Z","updated":"2026-08-10T12:05:38.691Z","title":"A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all…","severity":"HIGH","score":7.5,"vendor":"nodejs","product":"node","kev":false,"epss":0.03711,"kevAdded":null},{"id":"CVE-2026-48935","published":"2026-06-26T01:14:36.641Z","updated":"2026-06-26T15:05:20.661Z","title":"A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`. This…","severity":"LOW","score":3.3,"vendor":"nodejs","product":"node","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-48619","published":"2026-06-26T01:14:36.541Z","updated":"2026-06-26T15:01:43.942Z","title":"A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client. This…","severity":"MEDIUM","score":5.3,"vendor":"nodejs","product":"node","kev":false,"epss":0.00639,"kevAdded":null},{"id":"CVE-2026-48615","published":"2026-06-26T01:14:36.524Z","updated":"2026-06-26T13:35:00.592Z","title":"A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the…","severity":"MEDIUM","score":5.9,"vendor":"nodejs","product":"node","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2026-48931","published":"2026-06-22T18:59:30.822Z","updated":"2026-07-03T00:32:38.949Z","title":"A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects…","severity":"LOW","score":3.7,"vendor":"nodejs","product":"node","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2026-48937","published":"2026-06-18T18:01:39.780Z","updated":"2026-06-18T18:44:02.018Z","title":"A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supported…","severity":"MEDIUM","score":5.3,"vendor":"nodejs","product":"node","kev":false,"epss":0.00573,"kevAdded":null},{"id":"CVE-2026-48617","published":"2026-06-18T16:21:12.097Z","updated":"2026-06-18T18:34:10.166Z","title":"A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or…","severity":"LOW","score":1.8,"vendor":"nodejs","product":"node","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2026-21710","published":"2026-03-30T19:07:28.558Z","updated":"2026-07-15T01:19:57.306Z","title":"A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses…","severity":"HIGH","score":7.5,"vendor":"nodejs","product":"node","kev":false,"epss":0.25443,"kevAdded":null},{"id":"CVE-2026-21716","published":"2026-03-30T19:07:28.538Z","updated":"2026-03-31T14:27:23.323Z","title":"An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while…","severity":"LOW","score":3.3,"vendor":"nodejs","product":"node","kev":false,"epss":0.00142,"kevAdded":null},{"id":"CVE-2026-21711","published":"2026-03-30T19:07:28.526Z","updated":"2026-04-01T15:03:21.612Z","title":"A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all…","severity":"MEDIUM","score":5.3,"vendor":"nodejs","product":"node","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-21715","published":"2026-03-30T19:07:28.507Z","updated":"2026-09-17T18:36:37.076Z","title":"A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable…","severity":"LOW","score":3.3,"vendor":"nodejs","product":"node","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2026-21717","published":"2026-03-30T19:07:28.415Z","updated":"2026-05-10T13:16:01.620Z","title":"A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By…","severity":"MEDIUM","score":5.9,"vendor":"nodejs","product":"node","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2026-21713","published":"2026-03-30T19:07:28.356Z","updated":"2026-05-10T13:17:50.281Z","title":"A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information…","severity":"MEDIUM","score":5.9,"vendor":"nodejs","product":"node","kev":false,"epss":0.00366,"kevAdded":null},{"id":"CVE-2026-21714","published":"2026-03-30T19:07:28.317Z","updated":"2026-03-31T18:05:22.283Z","title":"A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to…","severity":"MEDIUM","score":5.3,"vendor":"nodejs","product":"node","kev":false,"epss":0.00431,"kevAdded":null},{"id":"CVE-2026-21712","published":"2026-03-30T15:13:59.172Z","updated":"2026-05-10T13:16:37.222Z","title":"A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN)…","severity":"MEDIUM","score":5.7,"vendor":"nodejs","product":"node","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-21636","published":"2026-01-20T20:41:55.700Z","updated":"2026-01-21T18:52:53.133Z","title":"A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without…","severity":"MEDIUM","score":5.8,"vendor":"nodejs","product":"node","kev":false,"epss":0.0087,"kevAdded":null},{"id":"CVE-2025-59466","published":"2026-01-20T20:41:55.628Z","updated":"2026-01-21T18:52:57.892Z","title":"We have identified a bug in Node.js error handling where \"Maximum call stack size exceeded\" errors become uncatchable when `async_hooks.createHook()` is…","severity":"MEDIUM","score":5.9,"vendor":"nodejs","product":"node","kev":false,"epss":0.00683,"kevAdded":null},{"id":"CVE-2025-55132","published":"2026-01-20T20:41:55.620Z","updated":"2026-01-21T18:53:03.738Z","title":"A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read…","severity":"LOW","score":2.8,"vendor":"nodejs","product":"node","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2025-59464","published":"2026-01-20T20:41:55.599Z","updated":"2026-01-21T20:41:09.437Z","title":"A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When…","severity":"MEDIUM","score":6.5,"vendor":"nodejs","product":"node","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2025-55131","published":"2026-01-20T20:41:55.591Z","updated":"2026-07-15T01:26:01.235Z","title":"A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout…","severity":"HIGH","score":7.1,"vendor":"nodejs","product":"node","kev":false,"epss":0.03455,"kevAdded":null},{"id":"CVE-2025-55130","published":"2026-01-20T20:41:55.393Z","updated":"2026-07-15T01:26:03.446Z","title":"A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By…","severity":"HIGH","score":7.1,"vendor":"nodejs","product":"node","kev":false,"epss":0.01697,"kevAdded":null},{"id":"CVE-2026-21637","published":"2026-01-20T20:41:55.352Z","updated":"2026-01-21T20:22:51.033Z","title":"A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use.…","severity":"MEDIUM","score":5.9,"vendor":"nodejs","product":"node","kev":false,"epss":0.01119,"kevAdded":null},{"id":"CVE-2025-59465","published":"2026-01-20T20:41:55.317Z","updated":"2026-07-15T01:25:48.829Z","title":"A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`.…","severity":"HIGH","score":7.5,"vendor":"nodejs","product":"node","kev":false,"epss":0.03962,"kevAdded":null},{"id":"CVE-2026-22036","published":"2026-01-14T19:07:13.745Z","updated":"2026-01-22T20:17:20.208Z","title":"Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion","severity":"MEDIUM","score":5.9,"vendor":"nodejs","product":"undici","kev":false,"epss":0.00457,"kevAdded":null},{"id":"CVE-2025-27210","published":"2025-07-18T22:54:27.227Z","updated":"2025-11-04T21:09:47.526Z","title":"An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. This vulnerability…","severity":"HIGH","score":7.5,"vendor":"nodejs","product":"node","kev":false,"epss":0.14338,"kevAdded":null},{"id":"CVE-2025-27209","published":"2025-07-18T22:54:27.205Z","updated":"2025-11-04T21:09:46.228Z","title":"The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. This implementation re-introduces the HashDoS vulnerability…","severity":"HIGH","score":7.5,"vendor":"nodejs","product":"node","kev":false,"epss":0.01253,"kevAdded":null},{"id":"CVE-2025-23165","published":"2025-05-19T01:25:08.569Z","updated":"2025-05-28T00:06:31.253Z","title":"In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently…","severity":"LOW","score":3.7,"vendor":"nodejs","product":"node","kev":false,"epss":0.00557,"kevAdded":null},{"id":"CVE-2025-23166","published":"2025-05-19T01:25:08.462Z","updated":"2025-05-28T00:07:12.640Z","title":"The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the…","severity":"HIGH","score":7.5,"vendor":"nodejs","product":"node","kev":false,"epss":0.00817,"kevAdded":null},{"id":"CVE-2025-23167","published":"2025-05-19T01:25:08.454Z","updated":"2025-05-27T18:31:36.494Z","title":"A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\\r\\n\\rX` instead of the required `\\r\\n\\r\\n`. This inconsistency enables…","severity":"MEDIUM","score":6.5,"vendor":"nodejs","product":"node","kev":false,"epss":0.00508,"kevAdded":null},{"id":"CVE-2025-47279","published":"2025-05-15T17:16:02.738Z","updated":"2026-02-06T19:14:56.281Z","title":"undici Denial of Service attack via bad certificate data","severity":"LOW","score":3.1,"vendor":"nodejs","product":"undici","kev":false,"epss":0.00339,"kevAdded":null},{"id":"CVE-2025-23085","published":"2025-02-07T07:09:25.804Z","updated":"2025-11-03T21:00:17.709Z","title":"A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected…","severity":"MEDIUM","score":5.3,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.01377,"kevAdded":null},{"id":"CVE-2025-23084","published":"2025-01-28T04:35:15.236Z","updated":"2025-11-04T21:09:38.409Z","title":"A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not…","severity":"MEDIUM","score":5.6,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.01588,"kevAdded":null},{"id":"CVE-2025-23083","published":"2025-01-22T01:11:30.802Z","updated":"2026-02-26T19:08:58.894Z","title":"With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also…","severity":"HIGH","score":7.7,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.00422,"kevAdded":null},{"id":"CVE-2025-22150","published":"2025-01-21T17:46:58.872Z","updated":"2025-02-12T20:41:22.041Z","title":"Undici Uses Insufficiently Random Values","severity":"MEDIUM","score":6.8,"vendor":"nodejs","product":"undici","kev":false,"epss":0.00763,"kevAdded":null},{"id":"CVE-2024-27980","published":"2025-01-09T00:33:47.722Z","updated":"2025-04-30T22:25:25.133Z","title":"Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands…","severity":"HIGH","score":8.1,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.01402,"kevAdded":null},{"id":"CVE-2024-37372","published":"2025-01-09T00:33:47.662Z","updated":"2025-05-02T23:03:00.375Z","title":"The Permission Model assumes that any path starting with two backslashes \\ has a four-character prefix that can be ignored, which is not always true. This…","severity":"LOW","score":3.6,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2023-46809","published":"2024-09-07T16:03:32.996Z","updated":"2025-11-04T18:18:49.086Z","title":"Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the…","severity":"HIGH","score":7.4,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.01302,"kevAdded":null},{"id":"CVE-2024-36138","published":"2024-09-07T16:00:36.011Z","updated":"2025-04-30T22:25:18.920Z","title":"Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn /…","severity":"HIGH","score":8.1,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.01098,"kevAdded":null},{"id":"CVE-2023-39333","published":"2024-09-07T16:00:36.005Z","updated":"2025-11-03T21:49:19.026Z","title":"Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that…","severity":"MEDIUM","score":5.3,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.01107,"kevAdded":null},{"id":"CVE-2024-36137","published":"2024-09-07T16:00:35.999Z","updated":"2025-04-30T22:25:18.074Z","title":"A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permission…","severity":"LOW","score":3.3,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.00395,"kevAdded":null},{"id":"CVE-2023-30582","published":"2024-09-07T16:00:35.978Z","updated":"2025-04-30T22:24:50.761Z","title":"A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a…","severity":"MEDIUM","score":5.3,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.0058,"kevAdded":null},{"id":"CVE-2023-30587","published":"2024-09-07T16:00:35.920Z","updated":"2025-04-30T22:24:55.029Z","title":"A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module…","severity":"HIGH","score":7.5,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.00747,"kevAdded":null},{"id":"CVE-2023-30583","published":"2024-09-07T16:00:35.918Z","updated":"2025-04-30T22:24:51.642Z","title":"fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the `--allow-fs-read` flag in Node.js 20. This…","severity":"HIGH","score":7.5,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.00722,"kevAdded":null},{"id":"CVE-2023-30584","published":"2024-09-07T16:00:35.915Z","updated":"2025-04-30T22:24:52.470Z","title":"A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of…","severity":"HIGH","score":7.7,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2024-22018","published":"2024-07-10T01:00:12.747Z","updated":"2025-04-30T22:25:19.795Z","title":"A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises…","severity":"LOW","score":2.9,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.00458,"kevAdded":null},{"id":"CVE-2024-22020","published":"2024-07-09T01:07:28.098Z","updated":"2025-04-30T22:25:20.702Z","title":"A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary…","severity":"MEDIUM","score":6.5,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.01104,"kevAdded":null},{"id":"CVE-2024-38372","published":"2024-07-08T20:25:59.111Z","updated":"2024-08-28T15:02:48.392Z","title":"Undici vulnerable to data leak when using response.arrayBuffer()","severity":"LOW","score":2,"vendor":"nodejs","product":"undici","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2024-27982","published":"2024-05-07T16:40:02.518Z","updated":"2025-11-04T22:06:04.271Z","title":"The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request…","severity":"MEDIUM","score":6.5,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.01155,"kevAdded":null},{"id":"CVE-2024-27983","published":"2024-04-09T01:06:43.681Z","updated":"2025-11-04T18:30:20.209Z","title":"An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is…","severity":"HIGH","score":8.2,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.87211,"kevAdded":null},{"id":"CVE-2024-30260","published":"2024-04-04T15:15:44.653Z","updated":"2025-11-04T16:11:54.904Z","title":"Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline","severity":"LOW","score":3.9,"vendor":"nodejs","product":"undici","kev":false,"epss":0.00734,"kevAdded":null},{"id":"CVE-2024-30261","published":"2024-04-04T15:09:11.369Z","updated":"2025-11-04T16:11:56.039Z","title":"Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect","severity":"LOW","score":2.6,"vendor":"nodejs","product":"undici","kev":false,"epss":0.00803,"kevAdded":null},{"id":"CVE-2024-22025","published":"2024-03-19T04:32:34.211Z","updated":"2025-11-04T16:11:11.894Z","title":"A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetch() function to…","severity":"MEDIUM","score":6.5,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.01309,"kevAdded":null},{"id":"CVE-2024-22017","published":"2024-03-19T04:32:34.137Z","updated":"2025-04-30T22:25:14.211Z","title":"setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged…","severity":"HIGH","score":7.3,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.00893,"kevAdded":null},{"id":"CVE-2024-21896","published":"2024-02-20T01:31:08.176Z","updated":"2025-04-30T22:25:13.375Z","title":"The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a…","severity":"HIGH","score":7.9,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.01262,"kevAdded":null},{"id":"CVE-2024-21890","published":"2024-02-20T01:31:08.153Z","updated":"2025-04-30T22:25:10.724Z","title":"The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example: ```…","severity":"MEDIUM","score":5,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.00945,"kevAdded":null},{"id":"CVE-2024-21891","published":"2024-02-20T01:31:08.152Z","updated":"2025-04-30T22:25:09.844Z","title":"Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined…","severity":"HIGH","score":7.9,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.01245,"kevAdded":null},{"id":"CVE-2024-22019","published":"2024-02-20T01:31:08.092Z","updated":"2025-11-04T16:11:10.950Z","title":"A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and…","severity":"HIGH","score":7.5,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.03168,"kevAdded":null},{"id":"CVE-2024-21892","published":"2024-02-20T01:31:08.073Z","updated":"2025-04-30T22:25:11.607Z","title":"On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated…","severity":"HIGH","score":7.5,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.00562,"kevAdded":null},{"id":"CVE-2024-24750","published":"2024-02-16T21:42:29.999Z","updated":"2025-02-13T17:40:21.089Z","title":"Backpressure request ignored in fetch() in Undici","severity":"MEDIUM","score":6.5,"vendor":"nodejs","product":"undici","kev":false,"epss":0.007,"kevAdded":null},{"id":"CVE-2024-24758","published":"2024-02-16T21:40:37.716Z","updated":"2025-02-13T17:40:21.660Z","title":"Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undici","severity":"LOW","score":3.9,"vendor":"nodejs","product":"undici","kev":false,"epss":0.00765,"kevAdded":null},{"id":"CVE-2023-30590","published":"2023-11-28T19:15:19.447Z","updated":"2026-10-08T21:13:52.073Z","title":"The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key…","severity":"HIGH","score":7.5,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.01462,"kevAdded":null},{"id":"CVE-2023-30588","published":"2023-11-28T19:15:19.430Z","updated":"2026-11-02T22:34:38.970Z","title":"When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible…","severity":"MEDIUM","score":5.3,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.01157,"kevAdded":null},{"id":"CVE-2023-30585","published":"2023-11-28T01:23:08.734Z","updated":"2026-10-08T21:13:54.831Z","title":"A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install Node.js using the .msi…","severity":"HIGH","score":7.5,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.01467,"kevAdded":null},{"id":"CVE-2023-30581","published":"2023-11-22T23:28:30.768Z","updated":"2025-11-03T21:48:01.028Z","title":"The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This…","severity":"HIGH","score":7.5,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.0105,"kevAdded":null},{"id":"CVE-2023-39331","published":"2023-10-18T03:55:18.506Z","updated":"2025-11-03T21:49:16.116Z","title":"A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the…","severity":"HIGH","score":7.7,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.01508,"kevAdded":null},{"id":"CVE-2023-38552","published":"2023-10-18T03:55:18.483Z","updated":"2025-11-03T21:49:14.670Z","title":"When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged…","severity":"HIGH","score":7.5,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.01236,"kevAdded":null},{"id":"CVE-2023-39332","published":"2023-10-18T03:55:18.469Z","updated":"2025-11-03T21:49:17.572Z","title":"Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the…","severity":"CRITICAL","score":9.8,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.02185,"kevAdded":null},{"id":"CVE-2023-45143","published":"2023-10-12T16:35:40.637Z","updated":"2025-02-13T17:13:50.221Z","title":"Undici's cookie header not cleared on cross-origin redirect in fetch","severity":"LOW","score":3.9,"vendor":"nodejs","product":"undici","kev":false,"epss":0.01368,"kevAdded":null},{"id":"CVE-2023-32558","published":"2023-09-12T01:36:55.861Z","updated":"2026-11-02T22:35:26.152Z","title":"The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all users using the…","severity":"HIGH","score":7.5,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.01743,"kevAdded":null},{"id":"CVE-2023-32005","published":"2023-09-12T01:36:55.851Z","updated":"2025-05-05T13:56:50.265Z","title":"A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a…","severity":"MEDIUM","score":5.3,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.01363,"kevAdded":null},{"id":"CVE-2023-32559","published":"2023-08-24T01:23:29.038Z","updated":"2025-11-04T16:10:11.750Z","title":"A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated…","severity":"HIGH","score":7.5,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.018,"kevAdded":null},{"id":"CVE-2023-32002","published":"2023-08-21T16:52:42.147Z","updated":"2025-07-02T14:48:45.647Z","title":"The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability…","severity":"CRITICAL","score":9.8,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.0161,"kevAdded":null},{"id":"CVE-2023-32003","published":"2023-08-15T15:10:29.363Z","updated":"2025-07-03T14:09:41.840Z","title":"`fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack. This flaw arises from a missing check in…","severity":"MEDIUM","score":5.3,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.0117,"kevAdded":null},{"id":"CVE-2023-32004","published":"2023-08-15T15:10:19.152Z","updated":"2025-05-08T16:05:43.836Z","title":"A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of…","severity":"HIGH","score":8.8,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.02129,"kevAdded":null},{"id":"CVE-2023-32006","published":"2023-08-15T15:10:09.447Z","updated":"2025-05-08T16:07:02.197Z","title":"The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.…","severity":"HIGH","score":8.8,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.01544,"kevAdded":null},{"id":"CVE-2023-30586","published":"2023-06-30T23:40:08.238Z","updated":"2025-05-08T16:14:11.957Z","title":"A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled,…","severity":"HIGH","score":7.5,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.01348,"kevAdded":null},{"id":"CVE-2023-30589","published":"2023-06-30T23:39:59.161Z","updated":"2026-10-08T21:13:51.947Z","title":"The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling…","severity":"HIGH","score":7.5,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.03906,"kevAdded":null},{"id":"CVE-2023-23920","published":"2023-02-23T00:00:00.000Z","updated":"2025-04-30T05:57:24.758Z","title":"An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load…","severity":"MEDIUM","score":4.2,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.00452,"kevAdded":null},{"id":"CVE-2023-23919","published":"2023-02-23T00:00:00.000Z","updated":"2025-04-30T05:56:08.249Z","title":"A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after…","severity":"HIGH","score":7.5,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.02209,"kevAdded":null},{"id":"CVE-2023-23918","published":"2023-02-23T00:00:00.000Z","updated":"2025-05-08T16:15:23.012Z","title":"A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions…","severity":"HIGH","score":7.5,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.02023,"kevAdded":null},{"id":"CVE-2023-23936","published":"2023-02-16T17:30:23.968Z","updated":"2025-03-10T21:10:26.495Z","title":"CRLF Injection in Nodejs ‘undici’ via host","severity":"MEDIUM","score":6.5,"vendor":"nodejs","product":"undici","kev":false,"epss":0.01129,"kevAdded":null},{"id":"CVE-2023-24807","published":"2023-02-16T17:30:19.923Z","updated":"2025-03-10T21:10:32.171Z","title":"Undici vulnerable to Regular Expression Denial of Service in Headers","severity":"HIGH","score":7.5,"vendor":"nodejs","product":"undici","kev":false,"epss":0.01315,"kevAdded":null},{"id":"CVE-2022-43548","published":"2022-12-05T00:00:00.000Z","updated":"2025-04-30T05:55:04.408Z","title":"A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can…","severity":"HIGH","score":8.1,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.14839,"kevAdded":null},{"id":"CVE-2022-35256","published":"2022-12-05T00:00:00.000Z","updated":"2025-04-30T22:24:47.709Z","title":"The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request…","severity":"MEDIUM","score":6.5,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.02764,"kevAdded":null},{"id":"CVE-2022-35255","published":"2022-12-05T00:00:00.000Z","updated":"2025-04-30T05:48:45.486Z","title":"A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in…","severity":"CRITICAL","score":9.1,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.02091,"kevAdded":null},{"id":"CVE-2022-35948","published":"2022-08-13T00:00:00.000Z","updated":"2025-04-22T17:42:05.598Z","title":"CRLF Injection in Nodejs ‘undici’ via Content-Type","severity":"MEDIUM","score":5.3,"vendor":"nodejs","product":"undici","kev":false,"epss":0.01391,"kevAdded":null},{"id":"CVE-2022-35949","published":"2022-08-12T00:00:00.000Z","updated":"2025-04-22T17:42:40.255Z","title":"`undici.request` vulnerable to SSRF using absolute URL on `pathname`","severity":"MEDIUM","score":5.3,"vendor":"nodejs","product":"undici","kev":false,"epss":0.01927,"kevAdded":null},{"id":"CVE-2022-31151","published":"2022-07-20T23:00:15.000Z","updated":"2025-04-22T17:48:20.472Z","title":"Uncleared cookies on cross-host/cross-origin redirect in undici","severity":"LOW","score":3.7,"vendor":"nodejs","product":"undici","kev":false,"epss":0.00739,"kevAdded":null},{"id":"CVE-2022-31150","published":"2022-07-19T20:40:10.000Z","updated":"2025-04-22T17:48:45.328Z","title":"CRLF injection in request headers","severity":"MEDIUM","score":5.3,"vendor":"nodejs","product":"undici","kev":false,"epss":0.01515,"kevAdded":null},{"id":"CVE-2022-32223","published":"2022-07-14T14:51:18.000Z","updated":"2025-04-30T22:24:45.953Z","title":"Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim…","severity":"HIGH","score":7.3,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.01752,"kevAdded":null},{"id":"CVE-2022-32222","published":"2022-07-14T00:00:00.000Z","updated":"2025-04-30T22:24:46.826Z","title":"A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be…","severity":"MEDIUM","score":5.3,"vendor":"NodeJS","product":"Node","kev":false,"epss":0.02186,"kevAdded":null},{"id":"CVE-2022-32215","published":"2022-07-14T00:00:00.000Z","updated":"2025-04-30T22:24:42.485Z","title":"The llhttp parser