Monthly
Unauthenticated denial of service in Countly Server prior to 24.05.50 and 25.03.44 lets any remote network attacker crash the Node.js process that serves the analytics API by requesting a public image or screenshot route (star-rating/images/, dashboards/images/screenshots/, /appimages/*, /memberimages/*, and other */screenshots/* paths) whose path contains a URL-encoded dot. On deployments using Countly's local filesystem storage backend, that crafted path makes createReadStream open a directory instead of a file; the resulting asynchronous EISDIR error has no listener on the piped stream, so it surfaces as an unhandled exception and terminates the server process. Repeated requests keep the API unavailable; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms a low-complexity, unauthenticated, availability-only impact with no confidentiality or integrity effect, and no public exploit code or CISA KEV entry was identified at time of analysis.
Denial of service in the undici HTTP client library for Node.js allows any attacker-controlled or compromised HTTPS endpoint to terminate the client process by performing a TLS 1.2 renegotiation. When a server renegotiates after the connection is established and presents a different CA-trusted certificate whose hostname does not match the requested host, Node.js re-runs hostname verification and destroys the socket with a certificate-altname error; undici's established-socket error handler treated that error code as impossible, so the peer-controlled condition became an uncaught assertion (CWE-248) that crashes Node.js and kills all in-flight requests and background work. The flaw affects undici 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1 on both the HTTP/1.1 and HTTP/2 paths, and is reachable through Node's global fetch() as well as direct library use; it is remotely triggerable without authentication or a CA compromise (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), though only TLS 1.2 connections are exploitable since TLS 1.3 removed renegotiation. No public exploit code was identified at time of analysis and there is no indication of confirmed active exploitation, but exploitation is trivial for any adversary who can serve an endpoint the victim fetches from, and patched releases 6.29.1, 7.30.1, and 8.12.2 are available.
Denial of service in the undici HTTP client library for Node.js (6.23.0-6.29.0, 7.18.0-7.30.0, and 8.0.0-8.12.1) lets a malicious or compromised remote server terminate the entire Node.js process with a single crafted response. When the server advertises more than five stacked content codings and then closes the connection before sending the body, undici rejects the response over its content-encoding limit, but it has already created the internal response stream and returns without attaching an error listener or aborting the request; the early close then surfaces a content-length mismatch on the orphaned stream as an uncaught error that Node.js handles by aborting the process. The flaw is client-side and remote-triggerable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), and - critically - the crash occurs even when the application correctly catches the fetch() rejection, so there is no public exploit identified at time of analysis and no vendor-provided workaround other than upgrading.
Unauthenticated remote denial of service in @libp2p/webrtc (the js-libp2p WebRTC transport) before 6.0.28 lets a single crafted UDP STUN Binding Request abort a Node.js webRTCDirect() listener process with SIGABRT, because the attacker-controlled ufrag field is forwarded into DirectRTCPeerConnection.setLocalDescription and reused as the ICE password without any length or character-set validation. The vulnerable code path runs before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, and connection-manager admission, so no credentials, prior connection, or user interaction are required - matching a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5). The confirmed impact is process termination only; no memory corruption, code execution, confidentiallity or integrity impact, browser-side impact, or connection-limit bypass has been demonstrated, and no public exploit code or CISA KEV entry was identified at time of analysis. Affected deployments are limited to Node.js peers that actively expose a webRTCDirect UDP listener; browser peers and nodes without such a listener are unaffected.
A nil-pointer panic in kin-openapi's openapi3filter validation path can crash any Go service that embeds versions 0.136.0 through 0.142.x and serves an OpenAPI 3.1 document with an array schema that omits the items keyword. Unauthenticated remote clients (CVSS vector PR:N/UI:N) only need to send a single nonempty application/x-www-form-urlencoded or multipart/form-data request to an affected operation - or trigger a matching response on a surface such as a response header - to deterministically panic ValidateRequest or ValidateResponse, producing denial of service with no confidentiality or integrity impact (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CVSS 7.5). The risk is real but bounded: only OpenAPI 3.1 specs containing the specific malformed-but-spec-legal array shape are exposed, JSON request bodies use a different decoder, and OpenAPI 3.0 documents are rejected at validation time. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation.
Unauthenticated remote attackers can cause the HPE NonStop ANSI SQLUTIL service to terminate unexpectedly, producing a denial-of-service condition on the targeted system. The flaw is rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning it is remotely reachable at low complexity with no credentials or user interaction required, and its impact is confined entirely to availability - there is no confidentiality or integrity effect. Root cause is classified as CWE-248 (Uncaught Exception), consistent with an unhandled error path that aborts the SQLUTIL process; no public exploit code has been identified at time of analysis, and the practical risk depends heavily on whether the SQLUTIL service is exposed to untrusted networks rather than restricted to internal administrative segments, since the affected component is part of the specialized HPE NonStop SQL/MX platform.
Denial of service in undici 8.11.0 and 8.11.1 allows a malicious or attacker-controlled HTTP/2 WebSocket server to terminate the Node.js process of any client that connects to it. Because the experimental WebSocket client is enabled by default whenever HTTP/2 is permitted (allowH2 defaults to true), an unauthenticated remote server can abort a failed handshake, leave the underlying HTTP/2 stream orphaned without an error listener, and then destroy the connection so the stream emits an uncaught error that crashes Node.js. Severity is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-248); there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and vendor-released patch 8.11.2 is available.
Unauthenticated remote attackers can terminate the Parse Server process by driving the email verification or password-reset flow while the configured mail provider rejects, rate-limits, or is unavailable - a state an attacker can force by rapidly issuing requests until the provider throttles. Only public application keys are required (no user account), and affected deployments are Parse Server before 8.6.97 and the 9.0.0 line before 9.10.2-alpha.6, with the server's email features enabled. The underlying defect is an uncaught exception (CWE-248) raised on a failed send that aborts the Node.js process, so a single rejected message produces a full service outage; no public exploit identified at time of analysis, and deployments with email flows disabled are unaffected.
An unauthenticated attacker with network reachability to the Windows Failover Clustering service can crash the cluster communication component by provoking an uncaught exception (CWE-248), resulting in a denial of service on the affected node. Windows Server 2019, Windows Server 2022, and Windows Server 2025 - including Server Core installations - are affected only when the Failover Clustering role/feature is configured; hosts without clustering enabled are not exposed. The CVSS 3.1 base score of 7.5 (HIGH) derives entirely from availability impact over a network vector requiring no privileges or user interaction (AV:N/AC:L/PR:N/UI:N, C:N/I:N/A:H), and no public exploit code has been identified at time of analysis.
Unauthenticated remote attackers can crash Node.js servers running Qwik server-side rendering by sending a crafted resource value that triggers an unhandled promise rejection, affecting @builder.io/qwik before 1.20.0 and @qwik.dev/core before 2.0.0-beta.37. This is an availability-only denial-of-service (CWE-248) assessed at CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), requiring no authentication or user interaction. No public exploit code or CISA KEV status is reported, but a single request can terminate a process under Node.js default unhandled-rejection policy.
Unauthenticated denial of service in Countly Server prior to 24.05.50 and 25.03.44 lets any remote network attacker crash the Node.js process that serves the analytics API by requesting a public image or screenshot route (star-rating/images/, dashboards/images/screenshots/, /appimages/*, /memberimages/*, and other */screenshots/* paths) whose path contains a URL-encoded dot. On deployments using Countly's local filesystem storage backend, that crafted path makes createReadStream open a directory instead of a file; the resulting asynchronous EISDIR error has no listener on the piped stream, so it surfaces as an unhandled exception and terminates the server process. Repeated requests keep the API unavailable; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms a low-complexity, unauthenticated, availability-only impact with no confidentiality or integrity effect, and no public exploit code or CISA KEV entry was identified at time of analysis.
Denial of service in the undici HTTP client library for Node.js allows any attacker-controlled or compromised HTTPS endpoint to terminate the client process by performing a TLS 1.2 renegotiation. When a server renegotiates after the connection is established and presents a different CA-trusted certificate whose hostname does not match the requested host, Node.js re-runs hostname verification and destroys the socket with a certificate-altname error; undici's established-socket error handler treated that error code as impossible, so the peer-controlled condition became an uncaught assertion (CWE-248) that crashes Node.js and kills all in-flight requests and background work. The flaw affects undici 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1 on both the HTTP/1.1 and HTTP/2 paths, and is reachable through Node's global fetch() as well as direct library use; it is remotely triggerable without authentication or a CA compromise (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), though only TLS 1.2 connections are exploitable since TLS 1.3 removed renegotiation. No public exploit code was identified at time of analysis and there is no indication of confirmed active exploitation, but exploitation is trivial for any adversary who can serve an endpoint the victim fetches from, and patched releases 6.29.1, 7.30.1, and 8.12.2 are available.
Denial of service in the undici HTTP client library for Node.js (6.23.0-6.29.0, 7.18.0-7.30.0, and 8.0.0-8.12.1) lets a malicious or compromised remote server terminate the entire Node.js process with a single crafted response. When the server advertises more than five stacked content codings and then closes the connection before sending the body, undici rejects the response over its content-encoding limit, but it has already created the internal response stream and returns without attaching an error listener or aborting the request; the early close then surfaces a content-length mismatch on the orphaned stream as an uncaught error that Node.js handles by aborting the process. The flaw is client-side and remote-triggerable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), and - critically - the crash occurs even when the application correctly catches the fetch() rejection, so there is no public exploit identified at time of analysis and no vendor-provided workaround other than upgrading.
Unauthenticated remote denial of service in @libp2p/webrtc (the js-libp2p WebRTC transport) before 6.0.28 lets a single crafted UDP STUN Binding Request abort a Node.js webRTCDirect() listener process with SIGABRT, because the attacker-controlled ufrag field is forwarded into DirectRTCPeerConnection.setLocalDescription and reused as the ICE password without any length or character-set validation. The vulnerable code path runs before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, and connection-manager admission, so no credentials, prior connection, or user interaction are required - matching a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5). The confirmed impact is process termination only; no memory corruption, code execution, confidentiallity or integrity impact, browser-side impact, or connection-limit bypass has been demonstrated, and no public exploit code or CISA KEV entry was identified at time of analysis. Affected deployments are limited to Node.js peers that actively expose a webRTCDirect UDP listener; browser peers and nodes without such a listener are unaffected.
A nil-pointer panic in kin-openapi's openapi3filter validation path can crash any Go service that embeds versions 0.136.0 through 0.142.x and serves an OpenAPI 3.1 document with an array schema that omits the items keyword. Unauthenticated remote clients (CVSS vector PR:N/UI:N) only need to send a single nonempty application/x-www-form-urlencoded or multipart/form-data request to an affected operation - or trigger a matching response on a surface such as a response header - to deterministically panic ValidateRequest or ValidateResponse, producing denial of service with no confidentiality or integrity impact (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CVSS 7.5). The risk is real but bounded: only OpenAPI 3.1 specs containing the specific malformed-but-spec-legal array shape are exposed, JSON request bodies use a different decoder, and OpenAPI 3.0 documents are rejected at validation time. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation.
Unauthenticated remote attackers can cause the HPE NonStop ANSI SQLUTIL service to terminate unexpectedly, producing a denial-of-service condition on the targeted system. The flaw is rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning it is remotely reachable at low complexity with no credentials or user interaction required, and its impact is confined entirely to availability - there is no confidentiality or integrity effect. Root cause is classified as CWE-248 (Uncaught Exception), consistent with an unhandled error path that aborts the SQLUTIL process; no public exploit code has been identified at time of analysis, and the practical risk depends heavily on whether the SQLUTIL service is exposed to untrusted networks rather than restricted to internal administrative segments, since the affected component is part of the specialized HPE NonStop SQL/MX platform.
Denial of service in undici 8.11.0 and 8.11.1 allows a malicious or attacker-controlled HTTP/2 WebSocket server to terminate the Node.js process of any client that connects to it. Because the experimental WebSocket client is enabled by default whenever HTTP/2 is permitted (allowH2 defaults to true), an unauthenticated remote server can abort a failed handshake, leave the underlying HTTP/2 stream orphaned without an error listener, and then destroy the connection so the stream emits an uncaught error that crashes Node.js. Severity is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-248); there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and vendor-released patch 8.11.2 is available.
Unauthenticated remote attackers can terminate the Parse Server process by driving the email verification or password-reset flow while the configured mail provider rejects, rate-limits, or is unavailable - a state an attacker can force by rapidly issuing requests until the provider throttles. Only public application keys are required (no user account), and affected deployments are Parse Server before 8.6.97 and the 9.0.0 line before 9.10.2-alpha.6, with the server's email features enabled. The underlying defect is an uncaught exception (CWE-248) raised on a failed send that aborts the Node.js process, so a single rejected message produces a full service outage; no public exploit identified at time of analysis, and deployments with email flows disabled are unaffected.
An unauthenticated attacker with network reachability to the Windows Failover Clustering service can crash the cluster communication component by provoking an uncaught exception (CWE-248), resulting in a denial of service on the affected node. Windows Server 2019, Windows Server 2022, and Windows Server 2025 - including Server Core installations - are affected only when the Failover Clustering role/feature is configured; hosts without clustering enabled are not exposed. The CVSS 3.1 base score of 7.5 (HIGH) derives entirely from availability impact over a network vector requiring no privileges or user interaction (AV:N/AC:L/PR:N/UI:N, C:N/I:N/A:H), and no public exploit code has been identified at time of analysis.
Unauthenticated remote attackers can crash Node.js servers running Qwik server-side rendering by sending a crafted resource value that triggers an unhandled promise rejection, affecting @builder.io/qwik before 1.20.0 and @qwik.dev/core before 2.0.0-beta.37. This is an availability-only denial-of-service (CWE-248) assessed at CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), requiring no authentication or user interaction. No public exploit code or CISA KEV status is reported, but a single request can terminate a process under Node.js default unhandled-rejection policy.