Nodejs vulnerabilities
144 CVEs and advisories name Nodejs as an affected vendor, newest first. Follow it as a feed.
- CVE-2024-27980Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject a
- CVE-2024-37372The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not alw
- CVE-2023-46809Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are
- CVE-2024-36138Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child
- CVE-2023-39333Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code.
- CVE-2024-36137A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.
- CVE-2023-30582A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read fla
- CVE-2023-30587A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspect
- CVE-2023-30583fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the `--allow-fs-read` flag in
- CVE-2023-30584A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model.
- CVE-2024-22018A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.
- CVE-2024-22020A security flaw in Node.js allows a bypass of network import restrictions.
- CVE-2024-38372Undici vulnerable to data leak when using response.arrayBuffer()
- CVE-2024-27982The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to
- CVE-2024-27983An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 f
- CVE-2024-30260Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline
- CVE-2024-30261Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect
- CVE-2024-22025A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fet
- CVE-2024-22017setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().
- CVE-2024-21896The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user.
- CVE-2024-21890The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path.
- CVE-2024-21891Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-d
- CVE-2024-22019A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resour
- CVE-2024-21892On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with
- CVE-2024-24750Backpressure request ignored in fetch() in Undici
- CVE-2024-24758Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undici
- CVE-2023-30590The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only gener
- CVE-2023-30588When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs…
- CVE-2023-30585A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install Nod
- CVE-2023-30581The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.jso