# cve.now: Nodejs The newest entries naming Nodejs as an affected vendor (up to 200), of 144 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md. - [CVE-2026-106069](https://cve.now/CVE-2026-106069.md): A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the… (CVSS 7.4) - [CVE-2026-105481](https://cve.now/CVE-2026-105481.md): A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent… (CVSS 6.5) - [CVE-2026-105482](https://cve.now/CVE-2026-105482.md): A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve\*() functions and… (CVSS 7.4) - [CVE-2026-106074](https://cve.now/CVE-2026-106074.md): A flaw in Node.js \`crypto\` causes the internal entropy caches used by \`crypto.randomUUID()\`, \`crypto.randomUUIDv7()\`, and… (CVSS 4.8) - [CVE-2026-106071](https://cve.now/CVE-2026-106071.md): A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard \`--allow-fs-read\` or… (CVSS 3.6) - [CVE-2026-106072](https://cve.now/CVE-2026-106072.md): A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client… (CVSS 6.7) - [CVE-2026-105483](https://cve.now/CVE-2026-105483.md): A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4… (CVSS 7.4) - [CVE-2026-106070](https://cve.now/CVE-2026-106070.md): A flaw in the Node.js \`zlib.ZipFile\` API can cause it to return bytes that do not belong to the requested entry after the local and… (CVSS 3.7) - [CVE-2026-106073](https://cve.now/CVE-2026-106073.md): A flaw in Node.js Permission Model filesystem enforcement leaves \`fs.realpathSync()\` without the required read permission checks. (CVSS 3.3) - [CVE-2026-48932](https://cve.now/CVE-2026-48932.md): A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from (CVSS 3.7) - [CVE-2026-56848](https://cve.now/CVE-2026-56848.md): A flaw in Node.js HTTP/2 handling allows \`nghttp2\_session\_mem\_send()\` to be called re-entrantly while \`nghttp2\_session\_mem\_recv()\` is execut (CVSS 7.5) - [CVE-2026-58042](https://cve.now/CVE-2026-58042.md): A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. (CVSS 5.9) - [CVE-2026-56846](https://cve.now/CVE-2026-56846.md): A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. (CVSS 7.5) - [CVE-2026-58044](https://cve.now/CVE-2026-58044.md): A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from (CVSS 3.7) - [CVE-2026-58045](https://cve.now/CVE-2026-58045.md): A flaw in Node.js allows a spoofed \`TypedArray\` \`byteLength\` to trigger a reachable assertion in the synchronous \`node:zlib\` APIs, causing t (CVSS 6.2) - [CVE-2026-58041](https://cve.now/CVE-2026-58041.md): A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cac (CVSS 5.3) - [CVE-2026-58039](https://cve.now/CVE-2026-58039.md): A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. (CVSS 3.3) - [CVE-2026-56847](https://cve.now/CVE-2026-56847.md): A flaw in Node.js Permission Model enforcement allows \`trace\_events.createTracing().enable()\` Writes Trace Logs Outside \`--allow-fs-write\`. (CVSS 3.3) - [CVE-2026-58043](https://cve.now/CVE-2026-58043.md): A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. (CVSS 7.5) - [CVE-2026-56850](https://cve.now/CVE-2026-56850.md): A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be (CVSS 4.1) - [CVE-2026-58040](https://cve.now/CVE-2026-58040.md): An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomp (CVSS 6.3) - [CVE-2026-48930](https://cve.now/CVE-2026-48930.md): A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation i (CVSS 5.6) - [CVE-2026-48928](https://cve.now/CVE-2026-48928.md): A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. (CVSS 4.2) - [CVE-2026-48934](https://cve.now/CVE-2026-48934.md): A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. (CVSS 4.3) - [CVE-2026-48936](https://cve.now/CVE-2026-48936.md): A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the \`--allow-net\` permissio (CVSS 3.3) - [CVE-2026-48618](https://cve.now/CVE-2026-48618.md): A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypas (CVSS 7.7) - [CVE-2026-48933](https://cve.now/CVE-2026-48933.md): A flaw in Node.js WebCrypto implementation can crash the process if the input of \`subtle.encrypt()\` is a multiple of 2GiB. (CVSS 7.5) - [CVE-2026-48935](https://cve.now/CVE-2026-48935.md): A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. (CVSS 3.3) - [CVE-2026-48619](https://cve.now/CVE-2026-48619.md): A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on (CVSS 5.3) - [CVE-2026-48615](https://cve.now/CVE-2026-48615.md): A flaw in Node.js proxy tunnel error handling could expose proxy credentials in \`ERR\_PROXY\_TUNNEL\` error messages. (CVSS 5.9) - [CVE-2026-48931](https://cve.now/CVE-2026-48931.md): A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. (CVSS 3.7) - [CVE-2026-48937](https://cve.now/CVE-2026-48937.md): A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a \`GOAWAY\` frame. (CVSS 5.3) - [CVE-2026-48617](https://cve.now/CVE-2026-48617.md): A flaw in Node.js Permission Model enforcement allows Bypass via \`process.report.writeReport()\` Path Misvalidation. (CVSS 1.8) - [CVE-2026-21710](https://cve.now/CVE-2026-21710.md): A flaw in Node.js HTTP request handling causes an uncaught \`TypeError\` when a request is received with a header named \`\_\_proto\_\_\` and the ap (CVSS 7.5) - [CVE-2026-21716](https://cve.now/CVE-2026-21716.md): An incomplete fix for CVE-2024-36137 leaves \`FileHandle.chmod()\` and \`FileHandle.chown()\` in the promises API without the required permissio (CVSS 3.3) - [CVE-2026-21711](https://cve.now/CVE-2026-21711.md): A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission che (CVSS 5.3) - [CVE-2026-21715](https://cve.now/CVE-2026-21715.md): A flaw in Node.js Permission Model filesystem enforcement leaves \`fs.realpathSync.native()\` without the required read permission checks, whi (CVSS 3.3) - [CVE-2026-21717](https://cve.now/CVE-2026-21717.md): A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially pr (CVSS 5.9) - [CVE-2026-21713](https://cve.now/CVE-2026-21713.md): A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing (CVSS 5.9) - [CVE-2026-21714](https://cve.now/CVE-2026-21714.md): A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW\_UPDATE frames on stream 0 (connection-level) that cause the flow c (CVSS 5.3) - [CVE-2026-21712](https://cve.now/CVE-2026-21712.md): A flaw in Node.js URL processing causes an assertion failure in native code when \`url.format()\` is called with a malformed internationalized (CVSS 5.7) - [CVE-2026-21636](https://cve.now/CVE-2026-21636.md): A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when \`--permission\` is enabl (CVSS 5.8) - [CVE-2025-59466](https://cve.now/CVE-2025-59466.md): We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when \`async\_hooks.crea (CVSS 5.9) - [CVE-2025-55132](https://cve.now/CVE-2025-55132.md): A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via \`futimes()\` even when the process (CVSS 2.8) - [CVE-2025-59464](https://cve.now/CVE-2025-59464.md): A memory leak in Node.js’s OpenSSL integration occurs when converting \`X.509\` certificate fields to UTF-8 without freeing the allocated buff (CVSS 6.5) - [CVE-2025-55131](https://cve.now/CVE-2025-55131.md): A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the \`vm\` module wit (CVSS 7.1) - [CVE-2025-55130](https://cve.now/CVE-2025-55130.md): A flaw in Node.js’s Permissions model allows attackers to bypass \`--allow-fs-read\` and \`--allow-fs-write\` restrictions using crafted relativ (CVSS 7.1) - [CVE-2026-21637](https://cve.now/CVE-2026-21637.md): A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when \`pskCallback\` or \`ALPNCallba (CVSS 5.9) - [CVE-2025-59465](https://cve.now/CVE-2025-59465.md): A malformed \`HTTP/2 HEADERS\` frame with oversized, invalid \`HPACK\` data can cause Node.js to crash by triggering an unhandled \`TLSSocket\` er (CVSS 7.5) - [CVE-2026-22036](https://cve.now/CVE-2026-22036.md): Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion (CVSS 5.9) - [CVE-2025-27210](https://cve.now/CVE-2025-27210.md): An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. (CVSS 7.5) - [CVE-2025-27209](https://cve.now/CVE-2025-27209.md): The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. (CVSS 7.5) - [CVE-2025-23165](https://cve.now/CVE-2025-23165.md): In Node.js, the \`ReadFileUtf8\` internal binding leaks memory due to a corrupted pointer in \`uv\_fs\_s.file\`: a UTF-16 path buffer is allocated (CVSS 3.7) - [CVE-2025-23166](https://cve.now/CVE-2025-23166.md): The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background t (CVSS 7.5) - [CVE-2025-23167](https://cve.now/CVE-2025-23167.md): A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \`\\r\\n\\rX\` instead of the required \`\\r\\n\\r\\n\`. (CVSS 6.5) - [CVE-2025-47279](https://cve.now/CVE-2025-47279.md): undici Denial of Service attack via bad certificate data (CVSS 3.1) - [CVE-2025-23085](https://cve.now/CVE-2025-23085.md): A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. (CVSS 5.3) - [CVE-2025-23084](https://cve.now/CVE-2025-23084.md): A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. (CVSS 5.6) - [CVE-2025-23083](https://cve.now/CVE-2025-23083.md): With the aid of the diagnostics\_channel utility, an event can be hooked into whenever a worker thread is created. (CVSS 7.7) - [CVE-2025-22150](https://cve.now/CVE-2025-22150.md): Undici Uses Insufficiently Random Values (CVSS 6.8) - [CVE-2024-27980](https://cve.now/CVE-2024-27980.md): Due to the improper handling of batch files in child\_process.spawn / child\_process.spawnSync, a malicious command line argument can inject a (CVSS 8.1) - [CVE-2024-37372](https://cve.now/CVE-2024-37372.md): The Permission Model assumes that any path starting with two backslashes \\ has a four-character prefix that can be ignored, which is not alw (CVSS 3.6) - [CVE-2023-46809](https://cve.now/CVE-2023-46809.md): Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are (CVSS 7.4) - [CVE-2024-36138](https://cve.now/CVE-2024-36138.md): Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child (CVSS 8.1) - [CVE-2023-39333](https://cve.now/CVE-2023-39333.md): Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. (CVSS 5.3) - [CVE-2024-36137](https://cve.now/CVE-2024-36137.md): A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. (CVSS 3.3) - [CVE-2023-30582](https://cve.now/CVE-2023-30582.md): A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read fla (CVSS 5.3) - [CVE-2023-30587](https://cve.now/CVE-2023-30587.md): A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspect (CVSS 7.5) - [CVE-2023-30583](https://cve.now/CVE-2023-30583.md): fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the \`--allow-fs-read\` flag in (CVSS 7.5) - [CVE-2023-30584](https://cve.now/CVE-2023-30584.md): A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. (CVSS 7.7) - [CVE-2024-22018](https://cve.now/CVE-2024-22018.md): A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. (CVSS 2.9) - [CVE-2024-22020](https://cve.now/CVE-2024-22020.md): A security flaw in Node.js allows a bypass of network import restrictions. (CVSS 6.5) - [CVE-2024-38372](https://cve.now/CVE-2024-38372.md): Undici vulnerable to data leak when using response.arrayBuffer() (CVSS 2.0) - [CVE-2024-27982](https://cve.now/CVE-2024-27982.md): The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to (CVSS 6.5) - [CVE-2024-27983](https://cve.now/CVE-2024-27983.md): An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 f (CVSS 8.2) - [CVE-2024-30260](https://cve.now/CVE-2024-30260.md): Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline (CVSS 3.9) - [CVE-2024-30261](https://cve.now/CVE-2024-30261.md): Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect (CVSS 2.6) - [CVE-2024-22025](https://cve.now/CVE-2024-22025.md): A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fet (CVSS 6.5) - [CVE-2024-22017](https://cve.now/CVE-2024-22017.md): setuid() does not affect libuv's internal io\_uring operations if initialized before the call to setuid(). (CVSS 7.3) - [CVE-2024-21896](https://cve.now/CVE-2024-21896.md): The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. (CVSS 7.9) - [CVE-2024-21890](https://cve.now/CVE-2024-21890.md): The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. (CVSS 5.0) - [CVE-2024-21891](https://cve.now/CVE-2024-21891.md): Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-d (CVSS 7.9) - [CVE-2024-22019](https://cve.now/CVE-2024-22019.md): A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resour (CVSS 7.5) - [CVE-2024-21892](https://cve.now/CVE-2024-21892.md): On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with (CVSS 7.5) - [CVE-2024-24750](https://cve.now/CVE-2024-24750.md): Backpressure request ignored in fetch() in Undici (CVSS 6.5) - [CVE-2024-24758](https://cve.now/CVE-2024-24758.md): Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undici (CVSS 3.9) - [CVE-2023-30590](https://cve.now/CVE-2023-30590.md): The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only gener (no CVSS) - [CVE-2023-30588](https://cve.now/CVE-2023-30588.md): When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs… (no CVSS) - [CVE-2023-30585](https://cve.now/CVE-2023-30585.md): A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install Nod (no CVSS) - [CVE-2023-30581](https://cve.now/CVE-2023-30581.md): The use of \_\_proto\_\_ in process.mainModule.\_\_proto\_\_.require() can bypass the policy mechanism and require modules outside of the policy.jso (CVSS 7.5) - [CVE-2023-39331](https://cve.now/CVE-2023-39331.md): A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. (CVSS 7.7) - [CVE-2023-38552](https://cve.now/CVE-2023-38552.md): When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation a (no CVSS) - [CVE-2023-39332](https://cve.now/CVE-2023-39332.md): Various \`node:fs\` functions allow specifying paths as either strings or \`Uint8Array\` objects. (no CVSS) - [CVE-2023-45143](https://cve.now/CVE-2023-45143.md): Undici's cookie header not cleared on cross-origin redirect in fetch (CVSS 3.9) - [CVE-2023-32558](https://cve.now/CVE-2023-32558.md): The use of the deprecated API \`process.binding()\` can bypass the permission model through path traversal. (no CVSS) - [CVE-2023-32005](https://cve.now/CVE-2023-32005.md): A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read fla (CVSS 5.3) - [CVE-2023-32559](https://cve.now/CVE-2023-32559.md): A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. (CVSS 7.5) - [CVE-2023-32002](https://cve.now/CVE-2023-32002.md): The use of \`Module.\_load()\` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. (CVSS 9.8) - [CVE-2023-32003](https://cve.now/CVE-2023-32003.md): \`fs.mkdtemp()\` and \`fs.mkdtempSync()\` can be used to bypass the permission model check using a path traversal attack. (CVSS 5.3) - [CVE-2023-32004](https://cve.now/CVE-2023-32004.md): A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. (CVSS 8.8) - [CVE-2023-32006](https://cve.now/CVE-2023-32006.md): The use of \`module.constructor.createRequire()\` can bypass the policy mechanism and require modules outside of the policy.json definition fo (CVSS 8.8) - [CVE-2023-30586](https://cve.now/CVE-2023-30586.md): A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission mo (CVSS 7.5) - [CVE-2023-30589](https://cve.now/CVE-2023-30589.md): The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. (no CVSS) - [CVE-2023-23920](https://cve.now/CVE-2023-23920.md): An untrusted search path vulnerability exists in Node.js. (CVSS 4.2) - [CVE-2023-23919](https://cve.now/CVE-2023-23919.md): A cryptographic vulnerability exists in Node.js \<19.2.0, \<18.14.1, \<16.19.1, \<14.21.3 that in some cases did does not clear the OpenSSL erro (CVSS 7.5) - [CVE-2023-23918](https://cve.now/CVE-2023-23918.md): A privilege escalation vulnerability exists in Node.js \<19.6.1, \<18.14.1, \<16.19.1 and \<14.21.3 that made it possible to bypass the experime (CVSS 7.5) - [CVE-2023-23936](https://cve.now/CVE-2023-23936.md): CRLF Injection in Nodejs ‘undici’ via host (CVSS 6.5) - [CVE-2023-24807](https://cve.now/CVE-2023-24807.md): Undici vulnerable to Regular Expression Denial of Service in Headers (CVSS 7.5) - [CVE-2022-43548](https://cve.now/CVE-2022-43548.md): A OS Command Injection vulnerability exists in Node.js versions \<14.21.1, \<16.18.1, \<18.12.1, \<19.0.1 due to an insufficient IsAllowedHost c (CVSS 8.1) - [CVE-2022-35256](https://cve.now/CVE-2022-35256.md): The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. (CVSS 6.5) - [CVE-2022-35255](https://cve.now/CVE-2022-35255.md): A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGe (CVSS 9.1) - [CVE-2022-35948](https://cve.now/CVE-2022-35948.md): CRLF Injection in Nodejs ‘undici’ via Content-Type (CVSS 5.3) - [CVE-2022-35949](https://cve.now/CVE-2022-35949.md): \`undici.request\` vulnerable to SSRF using absolute URL on \`pathname\` (CVSS 5.3) - [CVE-2022-31151](https://cve.now/CVE-2022-31151.md): Uncleared cookies on cross-host/cross-origin redirect in undici (CVSS 3.7) - [CVE-2022-31150](https://cve.now/CVE-2022-31150.md): CRLF injection in request headers (CVSS 5.3) - [CVE-2022-32223](https://cve.now/CVE-2022-32223.md): Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploi (no CVSS) - [CVE-2022-32222](https://cve.now/CVE-2022-32222.md): A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf t (no CVSS) - [CVE-2022-32215](https://cve.now/CVE-2022-32215.md): The llhttp parser \