Node.js CVE-2026-48617

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig

Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat

crypto/rsa/rsa_ameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to cause a denial

Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig

Command injection via Windows CreateProcess argument parsing affects multiple language runtimes and tooling (Node.js, PH

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for n