Nodejs vulnerabilities
144 CVEs and advisories name Nodejs as an affected vendor, newest first. Follow it as a feed.
- CVE-2023-39331A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6.
- CVE-2023-38552When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation a
- CVE-2023-39332Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects.
- CVE-2023-45143Undici's cookie header not cleared on cross-origin redirect in fetch
- CVE-2023-32558The use of the deprecated API `process.binding()` can bypass the permission model through path traversal.
- CVE-2023-32005A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read fla
- CVE-2023-32559A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
- CVE-2023-32002The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
- CVE-2023-32003`fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack.
- CVE-2023-32004A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model.
- CVE-2023-32006The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition fo
- CVE-2023-30586A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission mo
- CVE-2023-30589The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests.
- CVE-2023-23920An untrusted search path vulnerability exists in Node.js.
- CVE-2023-23919A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL erro
- CVE-2023-23918A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experime
- CVE-2023-23936CRLF Injection in Nodejs ‘undici’ via host
- CVE-2023-24807Undici vulnerable to Regular Expression Denial of Service in Headers
- CVE-2022-43548A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost c
- CVE-2022-35256The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF.
- CVE-2022-35255A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGe
- CVE-2022-35948CRLF Injection in Nodejs ‘undici’ via Content-Type
- CVE-2022-35949`undici.request` vulnerable to SSRF using absolute URL on `pathname`
- CVE-2022-31151Uncleared cookies on cross-host/cross-origin redirect in undici
- CVE-2022-31150CRLF injection in request headers
- CVE-2022-32223Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploi
- CVE-2022-32222A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf t
- CVE-2022-32215The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding hea
- CVE-2022-32214The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP re
- CVE-2022-32213The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding he