Node.js vulnerabilities
The newest vulnerabilities affecting Node.js, up to 200. Subscribe by RSS.
- CVE-2026-106069A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the cnodejs node
- CVE-2026-105481A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the nodejs node
- CVE-2026-105482A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.revnodejs node
- CVE-2026-106074A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt(nodejs node
- CVE-2026-106071A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allnodejs node
- CVE-2026-106072A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connectsnodejs node
- CVE-2026-105483A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 anodejs node
- CVE-2026-106070A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central nodejs node
- CVE-2026-106073A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks.nodejs node
- CVE-2026-48932A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from nodejs node
- CVE-2026-56848A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executnodejs node
- CVE-2026-58042A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records.nodejs node
- CVE-2026-56846A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion.nodejs node
- CVE-2026-58044A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from nodejs node
- CVE-2026-58045A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing tnodejs node
- CVE-2026-58041A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cacnodejs node
- CVE-2026-58039A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths.nodejs node
- CVE-2026-56847A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`.nodejs node
- CVE-2026-58043A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.nodejs node
- CVE-2026-56850A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to benodejs node
- CVE-2026-58040An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incompnodejs node
- CVE-2026-48930A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation inodejs node
- CVE-2026-48928A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups.nodejs node
- CVE-2026-48934A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.nodejs node
- CVE-2026-48936A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permissionodejs node
- CVE-2026-48618A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypasnodejs node
- CVE-2026-48933A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB.nodejs node
- CVE-2026-48935A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g.nodejs node
- CVE-2026-48619A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on nodejs node
- CVE-2026-48615A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages.nodejs node
- CVE-2026-48931A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request.nodejs node
- CVE-2026-48937A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame.nodejs node
- CVE-2026-48617A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation.nodejs node
- CVE-2026-21710A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the apnodejs node
- CVE-2026-21716An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permissionodejs node
- CVE-2026-21711A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission chenodejs node
- CVE-2026-21715A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, whinodejs node
- CVE-2026-21717A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially prnodejs node
- CVE-2026-21713A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timingnodejs node
- CVE-2026-21714A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow cnodejs node
- CVE-2026-21712A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalizednodejs node
- CVE-2026-21636A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enablnodejs node
- CVE-2025-59466We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.creanodejs node
- CVE-2025-55132A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process nodejs node
- CVE-2025-59464A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffnodejs node
- CVE-2025-55131A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module witnodejs node
- CVE-2025-55130A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relativnodejs node
- CVE-2026-21637A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallbanodejs node
- CVE-2025-59465A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` ernodejs node
- CVE-2026-22036Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustionnodejs undici · undici
- CVE-2025-11149This affects all versions of the package node-static; all versions of the package @nubosoftware/node-static.node-static · @nubosoftware/node-static
- CVE-2025-27210An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX.nodejs node · nodejs
- CVE-2025-27209The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash.nodejs node
- CVE-2025-23165In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocatednodejs node
- CVE-2025-23166The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background tnodejs node
- CVE-2025-23167A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`.nodejs node
- CVE-2025-47279undici Denial of Service attack via bad certificate datanodejs undici · undici
- CVE-2025-23085A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification.NodeJS Node
- CVE-2025-23084A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment.NodeJS Node
- CVE-2025-23083With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created.NodeJS Node
- CVE-2025-22150Undici Uses Insufficiently Random Valuesnodejs undici · undici
- CVE-2024-27980Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject aNodeJS Node
- CVE-2024-37372The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not alwNodeJS Node
- CVE-2024-21528All versions of the package node-gettext are vulnerable to Prototype Pollution via the addTranslations() function in gettext.js due to impronode-gettext
- CVE-2023-46809Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched areNodeJS Node
- CVE-2024-36138Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via childNodeJS Node
- CVE-2023-39333Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code.NodeJS Node
- CVE-2024-36137A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.NodeJS Node
- CVE-2023-30582A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flaNodeJS Node
- CVE-2023-30587A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspectNodeJS Node
- CVE-2023-30583fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the `--allow-fs-read` flag in NodeJS Node
- CVE-2023-30584A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model.NodeJS Node
- CVE-2024-21524All versions of the package node-stringbuilder are vulnerable to Out-of-bounds Read due to incorrect memory length calculation, by calling Tnode-stringbuilder
- CVE-2024-21525All versions of the package node-twain are vulnerable to Improper Check or Handling of Exceptional Conditions due to the length of the sourcnode-twain
- CVE-2024-22018A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.NodeJS Node
- CVE-2024-22020A security flaw in Node.js allows a bypass of network import restrictions.NodeJS Node
- CVE-2024-38372Undici vulnerable to data leak when using response.arrayBuffer()nodejs undici · undici
- CVE-2024-27982The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to NodeJS Node
- CVE-2024-3566Command injection vulnerability in programing languages on Microsoft Windows operating system.Node.js · Go Programming Language GoLang +1
- CVE-2024-27983An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 fNodeJS Node
- CVE-2024-30260Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipelinenodejs undici · undici
- CVE-2024-30261Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrectnodejs undici · undici
- CVE-2024-22025A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetNodeJS Node
- CVE-2024-22017setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().NodeJS Node
- CVE-2024-21896The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user.NodeJS Node
- CVE-2024-21890The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path.NodeJS Node
- CVE-2024-21891Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-dNodeJS Node
- CVE-2024-22019A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resourNodeJS Node
- CVE-2024-21892On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running withNodeJS Node
- CVE-2024-24750Backpressure request ignored in fetch() in Undicinodejs undici · undici
- CVE-2024-24758Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undicinodejs undici · undici
- CVE-2023-30590The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generNodeJS Node · node +1
- CVE-2023-30588When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs makiNodeJS Node
- CVE-2023-30585A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install NodNodeJS Node · node +1
- CVE-2023-30581The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.jsoNodeJS Node
- CVE-2023-39331A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6.NodeJS Node
- CVE-2023-38552When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation aNodeJS Node
- CVE-2023-39332Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects.NodeJS Node
- CVE-2023-26155All versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt() fails to sanitize node-qpdf
- CVE-2023-45143Undici's cookie header not cleared on cross-origin redirect in fetchnodejs undici · undici
- CVE-2023-32558The use of the deprecated API `process.binding()` can bypass the permission model through path traversal.NodeJS Node
- CVE-2023-32005A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flaNodeJS Node
- CVE-2023-32559A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.NodeJS Node
- CVE-2023-32002The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.NodeJS Node
- CVE-2023-32003`fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack.NodeJS Node
- CVE-2023-32004A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model.NodeJS Node
- CVE-2023-32006The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition foNodeJS Node
- CVE-2023-30586A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission moNodeJS Node
- CVE-2023-30589The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests.NodeJS Node · node +2
- CVE-2023-26109All versions of the package node-bluetooth-serial-port are vulnerable to Buffer Overflow via the findSerialPortChannel method due to impropenode-bluetooth-serial-port
- CVE-2023-26110All versions of the package node-bluetooth are vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user inputnode-bluetooth
- CVE-2023-26111All versions of the package @nubosoftware/node-static; all versions of the package node-static are vulnerable to Directory Traversal due to @nubosoftware/node-static · node-static
- CVE-2023-23918A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimeNodeJS Node
- CVE-2023-23919A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL erroNodeJS Node
- CVE-2023-23920An untrusted search path vulnerability exists in Node.js.NodeJS Node
- CVE-2023-23936CRLF Injection in Nodejs ‘undici’ via hostnodejs undici · undici
- CVE-2023-24807Undici vulnerable to Regular Expression Denial of Service in Headersnodejs undici · undici
- CVE-2022-35255A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGeNodeJS Node
- CVE-2022-35256The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF.NodeJS Node
- CVE-2022-43548A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost cNodeJS Node
- CVE-2022-3783node-red-dashboard ui_text Format ui-component-ctrl.js cross site scriptingnode-red-dashboard
- CVE-2022-24375Denial of Service (DoS)node-opcua
- CVE-2022-21208Denial of Service (DoS)node-opcua
- CVE-2022-25231Denial of Service (DoS)node-opcua
- CVE-2022-35948CRLF Injection in Nodejs ‘undici’ via Content-Typenodejs undici · undici
- CVE-2022-35949`undici.request` vulnerable to SSRF using absolute URL on `pathname`nodejs undici · undici
- CVE-2020-28433Command Injectionnode-latex-pdf
- CVE-2020-7678Arbitrary Code Executionnode-import
- CVE-2022-31151Uncleared cookies on cross-host/cross-origin redirect in undicinodejs undici · undici
- CVE-2022-31150CRLF injection in request headersnodejs undici · undici
- CVE-2022-32223Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploiNodeJS Node
- CVE-2022-32212A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that NodeJS Node
- CVE-2022-32213The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding heNodeJS Node · llhttp
- CVE-2022-32214The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP reNodeJS Node · llhttp
- CVE-2022-32215The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding heaNodeJS Node
- CVE-2022-32222A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf tNodeJS Node
- CVE-2022-23812Malicious Packagenode-ipc
- CVE-2022-21164Denial of Service (DoS)node-lmdb
- CVE-2021-44533Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly.NodeJS Node · node +1
- CVE-2021-44532Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format.NodeJS Node
- CVE-2021-44531Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bNodeJS Node
- CVE-2022-21824Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "propertiesNodeJS Node
- CVE-2021-22959The parser in accepts requests with a space (SP) right after the header name before the colon.NodeJS Node
- CVE-2021-22960The parse function in llhttp < 2.1.4 and < 6.0.6.NodeJS Node
- CVE-2021-22930Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory cNodeJS Node
- CVE-2021-22931Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validationNodeJS Node
- CVE-2021-22939If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned anNodeJS Node
- CVE-2021-22940Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory cNodeJS Node
- CVE-2021-22921Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platformNodeJS Node
- CVE-2021-22918Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII.NodeJS Node
- CVE-2018-1109A vulnerability was found in Braces versions 2.2.0 and above, prior to 2.3.1.nodejs-braces · braces
- CVE-2018-1107It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to havnodejs-is-my-json-valid · is-my-json-valid
- CVE-2019-10196A flaw was found in http-proxy-agent, prior to version 2.1.0.nodejs-http-proxy-agent · http-proxy-agent
- CVE-2021-22883Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an NodeJS Node
- CVE-2021-22884Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”.NodeJS Node
- CVE-2020-7785Command Injectionnode-ps
- CVE-2020-8265Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation.NodeJS Node
- CVE-2020-8287Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-ENodeJS Node
- CVE-2020-7789Command Injectionnode-notifier
- CVE-2020-8277A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versiNodeJS Node
- CVE-2020-7740Server-side Request Forgery (SSRF)node-pdf-generator
- CVE-2020-8201Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users.NodeJS Node
- CVE-2020-8252The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which NodeJS Node
- CVE-2020-8251Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unablNodeJS Node
- CVE-2020-7721Prototype Pollutionnode-oojs
- CVE-2020-7720Prototype Pollutionnode-forge
- CVE-2020-8215A buffer overflow is present in canvas version <= 1.6.9, which could lead to a Denial of Service or execution of arbitrary code when it procnode-canvas · canvas
- CVE-2020-7673node-extend through 0.2.0 is vulnerable to Arbitrary Code Execution.node-extend
- CVE-2020-7609node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands.node-rules
- CVE-2020-7632node-mpv through 1.4.3 is vulnerable to Command Injection.node-mpv
- CVE-2020-7627node-key-sender through 1.0.11 is vulnerable to Command Injection.node-key-sender
- CVE-2020-7602node-prompt-here through 1.0.1 allows execution of arbitrary commands.node-prompt-here
- CVE-2019-15606Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisoNodeJS Node
- CVE-2019-15604Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificateNodeJS Node
- CVE-2019-15605HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformedNodeJS Node
- CVE-2019-15607A stored XSS vulnerability is present within node-red (version: <= 0.20.7) npm package, which is a visual tool for wiring the Internet of Thnode-red
- CVE-2019-15597A code injection exists in node-df v0.1.4 that can allow an attacker to remote code execution by unsanitized input.node-df
- CVE-2019-10756It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting rawnode-red-dashboard
- CVE-2019-5739Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier.Node.js
- CVE-2019-5737In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of SNode.js
- CVE-2018-0114A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens uNode-jose Library · node-jose