Node.js EUVD-2026-39606

Command injection via Windows CreateProcess argument parsing affects multiple language runtimes and tooling (Node.js, PH

Hostname validation bypass in Node.js (versions 22.22.3, 24.16.0, and 26.3.0) lets attackers smuggle embedded NUL bytes

Node.js has a permissions model bypass that allows attackers to circumvent --allow-fs-read and --allow-fs-write restrict

Response queue poisoning in Node.js http.Agent allows network-accessible attackers to corrupt the HTTP keep-alive connec

Denial of service in Node.js 26.x (fixed in 26.3.1) arises from an unguarded integer overflow when computing WebCrypto c

Denial of service in Node.js HTTP/2 lets a remote peer exhaust process memory by driving unbounded growth of the connect

A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unha

Improper hostname normalization in Node.js TLS server-identity verification (fixed in v26.3.1) lets a TLS peer's hostnam

TLS SNI context matching in Node.js performs case-sensitive hostname comparison, enabling network-accessible low-privile

TLS session resumption in Node.js fails to bind reusable sessions to the originally authenticated host, enabling an info

Node.js permission model bypass via FileHandle.utimes() allows local low-privilege users to modify file timestamps on pa

Node.js Permission Model fails to apply net scope guards to pipe open and chmod operations, enabling a local authenticat