Node Js
Monthly
Improper URL construction in the @astrojs/node adapter for the Astro web framework (versions prior to 11.1.3) allows an unauthenticated remote client to terminate or disrupt a Node-hosted Astro site by sending a Host header whose port cannot be parsed, such as example.com:65536, example.com:99999, example.com:-1, example.com:abc, or a duplicated port like example.com:8080:8080. In the default standalone configuration the malformed host triggers an HTTP 500 while the server keeps running, but when the non-default staticHeaders option is enabled the exception is thrown from a synchronous handler, escapes the adapter's error handling, and crashes the Node process, producing a full availability loss. Impact is availability-only with no data exposure and no code execution path; any fronting proxy or CDN that rejects malformed Host headers prevents the request from reaching the origin and neutralizes the attack. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-released fix is @astrojs/node 11.1.3.
Authentication bypass in 9Router (npm package '9router') before 0.5.6 lets a remote, unauthenticated attacker reach the public LLM API under /api/v1/* by simply adding the header X-9r-Real-Ip: 127.0.0.1, which the application's isLocalRequest() logic in src/dashboardGuard.js trusts when deciding whether canAccessPublicLlmApi() may skip API-key validation. Successful abuse grants unauthorized use of the instance owner's configured LLM providers, consumption of paid credits, and enumeration of configured providers and models; the verified affected route is GET /api/v1/models. Per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, 7.3), no authentication or user interaction is required, but exploitation is only possible on deployments where requests reach Next.js directly without the bundled custom-server.js wrapper and where the LLM API is network-reachable (the default bind is 0.0.0.0); instances correctly served through custom-server.js are not exploitable. The vendor advisory includes a proof-of-concept showing a 401 baseline request succeeding with 200 OK after the sole header is added.
SQL injection in Chartbrew versions prior to 5.2.3 allows an unauthenticated remote attacker to break out of an intended string literal and execute arbitrary ClickHouse SQL whenever a ClickHouse-backed chart uses variable binding and the attacker controls the variable value; the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no privileges or user interaction are required, and the subsequent scope increase (SC:H/SI:H/SA:H) reflects impact landing on the ClickHouse data source rather than Chartbrew itself. The vulnerable path is fully exposed through public dashboards, while non-public dashboards require an authenticated session. Exploitation can disclose data stored in the ClickHouse instance and, where the ClickHouse configuration permits file or URL table functions, reach local files or internal network resources; vendor-released patch: 5.2.3, and no public exploit code has been identified at time of analysis. This is a genuine, high-priority CWE-89 issue with a credible unauthenticated path, though its reachability depends on the deployment using the ClickHouse plugin with variable bindings.
Stored cross-site scripting in Joplin Server before 3.7.7 allows an authenticated, low-privileged user to publish an empty-title resource whose attacker-controlled MIME type (image/svg+xml) is served inline, so a crafted SVG executes in a victim's browser when the public share link is opened. The flaw lives in the GET /shares/:id?resource_id= route, which reflects the user-supplied MIME and omits Content-Disposition when the resource title is empty; under the default configuration user content shares the Joplin Server application origin, so the script can read same-origin administrative data and anti-CSRF tokens and, against an authenticated victim, act with that victim's session. Installations that set a separate USER_CONTENT_BASE_URL still execute the script, but confined to the user-content origin; the issue is fixed in 3.7.7 and no public exploit code was identified at time of analysis.
Nodemailer versions 6.9.16 through 9.0.x mis-parse RFC 5322 comments inside recipient addresses, so a recipient written as 'user@good-corp.com(x)evil.com' is delivered by Nodemailer to 'good-corp.comevil.com' - a registrable domain an attacker can register - while a conformant RFC 5322 parser reads the domain as 'good-corp.com'. An unauthenticated remote attacker who can influence a recipient address can therefore reach a domain the sending application never approved, but only when the application makes its allow/deny decision on the domain using a strict RFC 5322 parser (without inspecting parse defects) or a naive prefix/substring allow-list and then hands the raw address to Nodemailer; the mis-parse propagates to both the SMTP envelope (RCPT TO) and the emitted To:/From: headers. This is a conditional, parser-disagreement issue assessed as Moderate (CVSS:3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) despite the vendor-published CVSS 4.0 score of 8.3; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. Vendor-released patch: 9.1.0.
IP spoofing in @fastify/proxy-addr 3.0.0 through 5.1.0 allows any unauthenticated remote client to control the client address an application believes it received, defeating IP-based access control, rate limiting, geolocation, and audit logging. The flaw is triggered only under a specific operator misconfiguration: a trusted-proxy subnet expressed in IPv4-mapped IPv6 notation with an IPv4-sized prefix (for example ::ffff:10.0.0.0/8) is silently accepted but expands to trust every IPv4 address, making the socket peer trusted at hop 0 so an attacker-supplied X-Forwarded-For header is honored. Vendor CVSS is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis; severity in practice is bounded by the misconfiguration precondition, and the issue is fixed in 5.1.1.
Node.js's Permission Model - enabled via the --permission flag - incorrectly grants access rights when an internal radix tree node is split during path resolution, allowing a locally executing low-privileged process to escape its configured filesystem access policy on versions 22.x through 22.23.1, 24.x through 24.18.0, and 26.x through 26.5.0. The scope change in the CVSS vector (S:C, C:H, I:H) reflects that a successfully exploiting process can read and write files on the host filesystem beyond what its permission policy permits - effectively defeating the sandbox. No public exploit code exists and CISA KEV listing is absent; EPSS at 0.14% (3rd percentile) reflects that real-world exploitation is currently minimal, consistent with the non-default nature of the affected feature.
Denial of service in Node.js HTTP/2 lets a remote peer exhaust process memory by driving unbounded growth of the connection's originSet, the structure that tracks origins advertised via HTTP/2 ORIGIN frames. It affects the 22.x, 24.x and 26.x release lines up to and including Node 22.22.3, 24.16.0 and 26.3.0, and is fixed in the June 2026 security release (26.3.1). There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.51%), but availability impact is rated High.
Denial of service in Node.js 26.x (fixed in 26.3.1) arises from an unguarded integer overflow when computing WebCrypto cipher output buffer lengths, allowing remote attackers to crash a process that performs SubtleCrypto encrypt/decrypt operations on attacker-influenced data. Rated High by the Node.js project (CVSS 7.5, availability-only impact). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Hostname validation bypass in Node.js (versions 22.22.3, 24.16.0, and 26.3.0) lets attackers smuggle embedded NUL bytes through the dns and net subsystems, truncating a hostname after the NUL so that application-level allowlists, SNI checks, or destination filters validate one host while the runtime resolves or connects to another. The Node.js project rates this specific issue Medium and shipped the fix in its June 2026 security release; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.28%, 20th percentile), and it is not in CISA KEV. Note a significant signal conflict: the aggregate input score of CVSS 9.8 with an 'Authentication Bypass' tag is far above the vendor's own Medium rating for this CVE and appears to be an inflated pre-NVD auto-score.
Improper access control in Node.js's experimental permission model allows a process running under restricted permissions to bypass write-path enforcement via process.chdir() when generating diagnostic reports. Affected are Node.js versions through 22.22.3, 24.16.0, and 26.3.0 across all three active release lines. No public exploit has been identified at time of analysis, and EPSS (0.20%, 10th percentile) and SSVC (exploitation: none, automatable: no) both indicate very low real-world exploitation likelihood - consistent with the Node.js security team's own 'Low' severity classification for this specific CVE within the June 2026 security release.
Sensitive information disclosure in Node.js (versions 26.3.0, 24.16.0, and 22.22.3) leaks embedded proxy credentials when a CONNECT tunnel connection fails, because the full proxy URL - including username and password - is included verbatim in the resulting tunnel error message rather than being redacted. Anyone able to read those error strings (application logs, error responses, monitoring/telemetry pipelines) can recover the proxy authentication secret. This is a Medium-rated, post-disclosure security-release fix (fixed in v26.3.1); there is no public exploit identified at time of analysis and EPSS is low at 0.38% (30th percentile).
Uncontrolled resource consumption in Node.js's HTTP/2 stack (≤24.16.0 and ≤22.22.3) enables remote unauthenticated denial-of-service via integration defects between Node.js and its bundled nghttp2 dependency (updated to 1.69.0 in the fix). The CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects fully network-exploitable, zero-interaction availability impact. No public exploit or active exploitation has been identified at time of analysis (EPSS 0.40%, SSVC exploitation: none), though CISA SSVC classifies the attack as automatable.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected.
Improper input validation in Nodemailer's address parser allows crafted recipient addresses to bypass domain allow-list checks and inject illegal characters into SMTP envelope commands, potentially causing email delivery failures or domain allow-list bypass. Affected versions are 3.0.0 through 10.0.12; the issue is remotely exploitable without authentication (PR:N) but requires an application that accepts attacker-influenced recipient input and relies on domain validation. No public exploit code or active exploitation has been identified at time of analysis; the assessed impact is integrity-only.
SQL injection in Chartbrew versions prior to 5.2.2 allows an authenticated user with access to the AI query orchestrator to smuggle arbitrary SQL into the database by influencing the model-generated row_limit value, which is concatenated into a trailing LIMIT clause after the application's read-only keyword check has already executed. Exploitation is conditional rather than trivial: the attacker cannot pass row_limit directly but must steer the LLM into emitting a non-integer value, and the connected data source must be of type postgres, mysql, or clickhouse for the vulnerable code path to apply. Impact is bounded by the privileges of the database account Chartbrew uses - data can be read or modified, and where that account has file or command privileges, file access or OS command execution becomes possible; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, with the vendor fix shipping in 5.2.2.
Outbound request validation bypass via DNS rebinding in Chartbrew before 5.2.2 allows an authenticated user who can create or test API/data-source connections, and who controls DNS for the target hostname, to make the server reach internal services, localhost resources, or cloud metadata endpoints. The server validates the hostname with validateOutboundUrl() but the actual connection is performed by request-promise using an independent DNS lookup, so a public address can be returned during validation and a private address during the request. No public exploit identified at time of analysis; exploitation requires a credentialed account and attacker-controlled DNS plus winning the race between the two lookups, so real-world risk is moderate rather than high.
Joplin Server prior to 3.7.7 lets an authenticated low-privileged user who holds a *pending* (not yet accepted) folder-share invitation write new items directly into that shared folder, because ItemModel.checkIfAllowed() accepts any share_users row for the caller without requiring ShareUserStatus.Accepted. The injected content is then pushed out to the share owner and already-accepted participants by ShareModel.updateSharedItems3() before the attacker ever accepts the invitation, giving unauthorized content injection into another user's notebook. The flaw requires the invitation precondition, so it is not exploitable against arbitrary shares or default configurations with no pending invite; impact is integrity-only (CVSS 3.1 base 4.3, C:N/I:L/A:N, PR:L), no public exploit code was identified at time of analysis, and the issue is fixed in 3.7.7.
Server-side request forgery in CKAN MCP Server (ondata/@aborruso ckan-mcp-server) before version 0.4.108 allows an attacker who can influence the caller-supplied server_url parameter to force the server to issue requests to loopback addresses and to the cloud instance metadata service at 169.254.169.254. The flaw is the third bypass of the same validateServerUrl guard: because that guard only inspects the hostname string and never resolves DNS, any hostname that resolves to an internal address (documented examples lvh.me to 127.0.0.1 and *.nip.io to IMDS) slips through, and exploitation realistically requires prompt injection into content the victim's AI assistant processes while the MCP server is connected (CVSS UI:R). No confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis, though a proof-of-concept for an earlier, related SSRF variant in the same package is published; impact is highest for cloud-hosted deployments where IMDS returns IAM credentials.
HTTPS agent connection pooling in Node.js fails to distinguish PFX credentials when encoded as an object versus an array, enabling authentication bypass under specific mutual-TLS configurations. Affected are Node.js 22.x through 22.23.1, 24.x through 24.18.0, and 26.x through 26.5.0. A high-privileged local actor who controls HTTPS agent configuration can induce the runtime to reuse a TLS session authenticated with one PFX credential for a request that should require a different (or no) credential, undermining certificate-based identity verification. No public exploit or CISA KEV listing has been identified at time of analysis.
Node.js Permission Model fails to enforce filesystem write restrictions for the trace events subsystem, allowing a local attacker with low privileges to write files to paths explicitly blocked by the operator via the --experimental-permission flag. Rated Low severity (CVSS 3.3), this flaw affects Node.js 22.x through 22.23.1, 24.x through 24.18.0, and 26.x through 26.5.0, and is one of ten CVEs addressed in the July 2026 Node.js security release. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the fix is available in Node.js 26.5.1 released 2026-07-29.
TLS session resumption in Node.js fails to bind reusable sessions to the originally authenticated host, enabling an information disclosure pathway. Affected versions are Node.js 26.x prior to 26.3.1 (Current channel), as disclosed in the June 2026 security release. An attacker with low network-level privilege can cause a cached TLS session-established and authenticated against one hostname-to be reused for a distinct, attacker-influenced host, potentially bypassing host-based authentication. No public exploit code or CISA KEV listing is present at time of analysis.
Response queue poisoning in Node.js http.Agent allows network-accessible attackers to corrupt the HTTP keep-alive connection pool via a TOCTOU race condition, causing responses to be delivered to the wrong request handler. Affected is Node.js v26.x prior to v26.3.1, as disclosed in the June 2026 security release. Exploitation requires high attack complexity due to the race window, and no public exploit has been identified at time of analysis; this is rated Low severity (CVSS 3.7) by the Node.js team.
Improper hostname normalization in Node.js TLS server-identity verification (fixed in v26.3.1) lets a TLS peer's hostname be evaluated without proper Unicode/case normalization, so identity checks may match a host they should reject. Rated High by the Node.js team (CVSS 7.7, scope-changed, confidentiality-only), it can cause a client to trust the wrong server and expose data carried over the connection. No public exploit identified at time of analysis; this was disclosed pre-NVD via the nodejs/node June 2026 security release and is not listed in CISA KEV.
Node.js permission model bypass via FileHandle.utimes() allows local low-privilege users to modify file timestamps on paths outside their permitted write scope. Affecting Node.js 26.x before v26.3.1, this flaw is only exploitable when the experimental permission model is explicitly enabled via --experimental-permission, substantially limiting exposure. No public exploit code or active exploitation has been identified at time of analysis, and the vendor-released patch (v26.3.1) is confirmed available as of 2026-06-18.
TLS SNI context matching in Node.js performs case-sensitive hostname comparison, enabling network-accessible low-privileged attackers to bypass intended server-side TLS context selection by varying the casing of the SNI hostname in a ClientHello message. Affected versions prior to 26.3.1 may serve an incorrect TLS certificate or context when a client sends an SNI value with unexpected casing (e.g., 'EXAMPLE.COM' versus 'example.com'), yielding limited confidentiality and integrity impacts in multi-hostname deployments. No public exploit code or active exploitation has been identified; the fix shipped as part of the Node.js June 2026 coordinated security release alongside ten other CVEs.
Node.js Permission Model fails to apply net scope guards to pipe open and chmod operations, enabling a local authenticated user to bypass intended access control boundaries enforced by the experimental Permission Model. Affected is Node.js v26.x prior to v26.3.1 (Current release line), disclosed in the June 2026 security release. Rated Low severity by the Node.js team; no public exploit identified at time of analysis and not listed in CISA KEV.
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. [CVSS 7.5 HIGH]
Node.js has a permissions model bypass that allows attackers to circumvent --allow-fs-read and --allow-fs-write restrictions using alternate path representations.
Memory and availability pressure in the npm package qs (versions before 6.14.1) stems from an input-validation gap where the arrayLimit parse option is enforced for indexed array notation (a[0]=1) but not for bracket notation (a[]=1), letting attackers control how many array elements are materialized for a single key from an attacker-supplied query string. Exploitation requires a non-default configuration: the application must use qs to parse attacker-controlled query strings with parseArrays enabled (the default) and, critically, parameterLimit explicitly raised well above its default of 1000, because parameterLimit independently caps total parsed parameters and neutralizes the issue under default settings. Unauthenticated remote attackers face no user interaction, but impact is bounded to low availability/memory pressure rather than code execution; publicly available exploit code exists (PoC in vendor advisory GHSA-6rw7-vpxm-498p), a vendor patch is available in qs 6.14.1, and EPSS is only 0.45% (37th percentile), consistent with the vendor's own severity downgrade.
Cached HTTP responses can be served to the wrong authenticated user in axios-cache-interceptor before 1.11.1, leaking data across sessions and bypassing authorization checks in server-side deployments. The library builds its cache key from the request URL alone and ignores the upstream's `Vary: Authorization` response header, so when a backend, proxy, or API serves multiple users with different bearer tokens through a single cache instance, an authenticated attacker holding a valid low-privileged token (CVSS PR:L) who requests the same URL can receive another user's cached response; exploitation is timing- and configuration-dependent because the victim's response must already be cached. Publicly available exploit code exists (a full proof-of-concept is published in the GitHub advisory), while EPSS is low at 0.32% (22nd percentile) and CISA KEV does not list this issue, making this a genuine but conditional authorization-bypass flaw of moderate rather than urgent risk.
Prototype pollution in apidoc-core 0.2.0 and all later versions lets an attacker who can influence the data structures parsed by the library corrupt JavaScript object prototypes through a crafted 'define' property handled by the preProcess() function, potentially causing denial of service or unexpected behavior in the consuming application. The affected parsing is typically applied to developer-authored API annotation comments, which are trusted build-time inputs; real risk only materializes when an integrating application feeds untrusted or externally-supplied data into this parser. No public exploit identified at time of analysis, and no confirmed active exploitation (no KEV listing); the supplied CVSS 4.0 score of 9.3 (network, unauthenticated, high CIA impact) is not supported by the independent assessment, which rates the issue as a local-vector, low-integrity and low-availability impact flaw rather than a confirmed remote compromise.
Unsafe deserialization in React Server Components Server Function endpoints allows remote unauthenticated attackers to trigger an infinite loop that hangs the server process and can prevent subsequent HTTP requests from being served. The flaw affects React 19.0.2, 19.1.3, and 19.2.2 - including Next.js applications on Node.js that expose Server Functions (Server Actions) - and it represents an incomplete fix for CVE-2025-55184. EPSS is 19.99% (97th percentile), and no public exploit identified at time of analysis; CISA KEV does not list it as confirmed actively exploited.
Unvalidated reflection of the X-Forwarded-Host header in Astro (versions before 5.14.3) lets remote, unauthenticated attackers control the host value returned by the Astro.url property, which can be abused for canonical-link manipulation, redirecting credentials submitted through login or registration form URLs, and - when a caching proxy is in front - poisoning cached pages for subsequent users. Only deployments running Astro in on-demand/dynamic (SSR) rendering mode through a server adapter such as the Node adapter, behind a proxy that forwards the attacker-supplied X-Forwarded-Host header, and whose code actually consumes Astro.url are affected; statically generated Astro sites are not. Publicly available exploit code exists (the GitHub advisory includes a working curl PoC and a reference repository), but the issue is not listed in CISA KEV and EPSS is low at 0.41% (33rd percentile), with the independent assessment treating it as a moderate, context-dependent integrity risk rather than an emergency.
A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Command injection via Windows CreateProcess argument parsing affects multiple language runtimes and tooling (Node.js, PHP, Rust, Haskell process library, yt-dlp) that wrap the API without compensating for its quirks. Remote attackers can smuggle additional commands through arguments passed to child processes when applications spawn batch files or otherwise rely on CreateProcess's implicit cmd.exe handling. Publicly available exploit code exists and EPSS of 7.09% (92nd percentile) signals elevated, though not confirmed in-the-wild, exploitation interest; this CVE is not listed in CISA KEV.
A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install Node.js using the .msi installer. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
`fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An untrusted search path vulnerability exists in Node.js. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity.
A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
Undici is an HTTP/1.1 client for Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required.
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 20.6%.
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 83.2%.
Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity.
A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to. Rated medium severity (CVSS 5.6), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required.
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
The X.509 GeneralName type is a generic type for representing different types of names. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper URL construction in the @astrojs/node adapter for the Astro web framework (versions prior to 11.1.3) allows an unauthenticated remote client to terminate or disrupt a Node-hosted Astro site by sending a Host header whose port cannot be parsed, such as example.com:65536, example.com:99999, example.com:-1, example.com:abc, or a duplicated port like example.com:8080:8080. In the default standalone configuration the malformed host triggers an HTTP 500 while the server keeps running, but when the non-default staticHeaders option is enabled the exception is thrown from a synchronous handler, escapes the adapter's error handling, and crashes the Node process, producing a full availability loss. Impact is availability-only with no data exposure and no code execution path; any fronting proxy or CDN that rejects malformed Host headers prevents the request from reaching the origin and neutralizes the attack. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-released fix is @astrojs/node 11.1.3.
Authentication bypass in 9Router (npm package '9router') before 0.5.6 lets a remote, unauthenticated attacker reach the public LLM API under /api/v1/* by simply adding the header X-9r-Real-Ip: 127.0.0.1, which the application's isLocalRequest() logic in src/dashboardGuard.js trusts when deciding whether canAccessPublicLlmApi() may skip API-key validation. Successful abuse grants unauthorized use of the instance owner's configured LLM providers, consumption of paid credits, and enumeration of configured providers and models; the verified affected route is GET /api/v1/models. Per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, 7.3), no authentication or user interaction is required, but exploitation is only possible on deployments where requests reach Next.js directly without the bundled custom-server.js wrapper and where the LLM API is network-reachable (the default bind is 0.0.0.0); instances correctly served through custom-server.js are not exploitable. The vendor advisory includes a proof-of-concept showing a 401 baseline request succeeding with 200 OK after the sole header is added.
SQL injection in Chartbrew versions prior to 5.2.3 allows an unauthenticated remote attacker to break out of an intended string literal and execute arbitrary ClickHouse SQL whenever a ClickHouse-backed chart uses variable binding and the attacker controls the variable value; the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no privileges or user interaction are required, and the subsequent scope increase (SC:H/SI:H/SA:H) reflects impact landing on the ClickHouse data source rather than Chartbrew itself. The vulnerable path is fully exposed through public dashboards, while non-public dashboards require an authenticated session. Exploitation can disclose data stored in the ClickHouse instance and, where the ClickHouse configuration permits file or URL table functions, reach local files or internal network resources; vendor-released patch: 5.2.3, and no public exploit code has been identified at time of analysis. This is a genuine, high-priority CWE-89 issue with a credible unauthenticated path, though its reachability depends on the deployment using the ClickHouse plugin with variable bindings.
Stored cross-site scripting in Joplin Server before 3.7.7 allows an authenticated, low-privileged user to publish an empty-title resource whose attacker-controlled MIME type (image/svg+xml) is served inline, so a crafted SVG executes in a victim's browser when the public share link is opened. The flaw lives in the GET /shares/:id?resource_id= route, which reflects the user-supplied MIME and omits Content-Disposition when the resource title is empty; under the default configuration user content shares the Joplin Server application origin, so the script can read same-origin administrative data and anti-CSRF tokens and, against an authenticated victim, act with that victim's session. Installations that set a separate USER_CONTENT_BASE_URL still execute the script, but confined to the user-content origin; the issue is fixed in 3.7.7 and no public exploit code was identified at time of analysis.
Nodemailer versions 6.9.16 through 9.0.x mis-parse RFC 5322 comments inside recipient addresses, so a recipient written as 'user@good-corp.com(x)evil.com' is delivered by Nodemailer to 'good-corp.comevil.com' - a registrable domain an attacker can register - while a conformant RFC 5322 parser reads the domain as 'good-corp.com'. An unauthenticated remote attacker who can influence a recipient address can therefore reach a domain the sending application never approved, but only when the application makes its allow/deny decision on the domain using a strict RFC 5322 parser (without inspecting parse defects) or a naive prefix/substring allow-list and then hands the raw address to Nodemailer; the mis-parse propagates to both the SMTP envelope (RCPT TO) and the emitted To:/From: headers. This is a conditional, parser-disagreement issue assessed as Moderate (CVSS:3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) despite the vendor-published CVSS 4.0 score of 8.3; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. Vendor-released patch: 9.1.0.
IP spoofing in @fastify/proxy-addr 3.0.0 through 5.1.0 allows any unauthenticated remote client to control the client address an application believes it received, defeating IP-based access control, rate limiting, geolocation, and audit logging. The flaw is triggered only under a specific operator misconfiguration: a trusted-proxy subnet expressed in IPv4-mapped IPv6 notation with an IPv4-sized prefix (for example ::ffff:10.0.0.0/8) is silently accepted but expands to trust every IPv4 address, making the socket peer trusted at hop 0 so an attacker-supplied X-Forwarded-For header is honored. Vendor CVSS is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis; severity in practice is bounded by the misconfiguration precondition, and the issue is fixed in 5.1.1.
Node.js's Permission Model - enabled via the --permission flag - incorrectly grants access rights when an internal radix tree node is split during path resolution, allowing a locally executing low-privileged process to escape its configured filesystem access policy on versions 22.x through 22.23.1, 24.x through 24.18.0, and 26.x through 26.5.0. The scope change in the CVSS vector (S:C, C:H, I:H) reflects that a successfully exploiting process can read and write files on the host filesystem beyond what its permission policy permits - effectively defeating the sandbox. No public exploit code exists and CISA KEV listing is absent; EPSS at 0.14% (3rd percentile) reflects that real-world exploitation is currently minimal, consistent with the non-default nature of the affected feature.
Denial of service in Node.js HTTP/2 lets a remote peer exhaust process memory by driving unbounded growth of the connection's originSet, the structure that tracks origins advertised via HTTP/2 ORIGIN frames. It affects the 22.x, 24.x and 26.x release lines up to and including Node 22.22.3, 24.16.0 and 26.3.0, and is fixed in the June 2026 security release (26.3.1). There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.51%), but availability impact is rated High.
Denial of service in Node.js 26.x (fixed in 26.3.1) arises from an unguarded integer overflow when computing WebCrypto cipher output buffer lengths, allowing remote attackers to crash a process that performs SubtleCrypto encrypt/decrypt operations on attacker-influenced data. Rated High by the Node.js project (CVSS 7.5, availability-only impact). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Hostname validation bypass in Node.js (versions 22.22.3, 24.16.0, and 26.3.0) lets attackers smuggle embedded NUL bytes through the dns and net subsystems, truncating a hostname after the NUL so that application-level allowlists, SNI checks, or destination filters validate one host while the runtime resolves or connects to another. The Node.js project rates this specific issue Medium and shipped the fix in its June 2026 security release; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.28%, 20th percentile), and it is not in CISA KEV. Note a significant signal conflict: the aggregate input score of CVSS 9.8 with an 'Authentication Bypass' tag is far above the vendor's own Medium rating for this CVE and appears to be an inflated pre-NVD auto-score.
Improper access control in Node.js's experimental permission model allows a process running under restricted permissions to bypass write-path enforcement via process.chdir() when generating diagnostic reports. Affected are Node.js versions through 22.22.3, 24.16.0, and 26.3.0 across all three active release lines. No public exploit has been identified at time of analysis, and EPSS (0.20%, 10th percentile) and SSVC (exploitation: none, automatable: no) both indicate very low real-world exploitation likelihood - consistent with the Node.js security team's own 'Low' severity classification for this specific CVE within the June 2026 security release.
Sensitive information disclosure in Node.js (versions 26.3.0, 24.16.0, and 22.22.3) leaks embedded proxy credentials when a CONNECT tunnel connection fails, because the full proxy URL - including username and password - is included verbatim in the resulting tunnel error message rather than being redacted. Anyone able to read those error strings (application logs, error responses, monitoring/telemetry pipelines) can recover the proxy authentication secret. This is a Medium-rated, post-disclosure security-release fix (fixed in v26.3.1); there is no public exploit identified at time of analysis and EPSS is low at 0.38% (30th percentile).
Uncontrolled resource consumption in Node.js's HTTP/2 stack (≤24.16.0 and ≤22.22.3) enables remote unauthenticated denial-of-service via integration defects between Node.js and its bundled nghttp2 dependency (updated to 1.69.0 in the fix). The CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects fully network-exploitable, zero-interaction availability impact. No public exploit or active exploitation has been identified at time of analysis (EPSS 0.40%, SSVC exploitation: none), though CISA SSVC classifies the attack as automatable.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected.
Improper input validation in Nodemailer's address parser allows crafted recipient addresses to bypass domain allow-list checks and inject illegal characters into SMTP envelope commands, potentially causing email delivery failures or domain allow-list bypass. Affected versions are 3.0.0 through 10.0.12; the issue is remotely exploitable without authentication (PR:N) but requires an application that accepts attacker-influenced recipient input and relies on domain validation. No public exploit code or active exploitation has been identified at time of analysis; the assessed impact is integrity-only.
SQL injection in Chartbrew versions prior to 5.2.2 allows an authenticated user with access to the AI query orchestrator to smuggle arbitrary SQL into the database by influencing the model-generated row_limit value, which is concatenated into a trailing LIMIT clause after the application's read-only keyword check has already executed. Exploitation is conditional rather than trivial: the attacker cannot pass row_limit directly but must steer the LLM into emitting a non-integer value, and the connected data source must be of type postgres, mysql, or clickhouse for the vulnerable code path to apply. Impact is bounded by the privileges of the database account Chartbrew uses - data can be read or modified, and where that account has file or command privileges, file access or OS command execution becomes possible; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, with the vendor fix shipping in 5.2.2.
Outbound request validation bypass via DNS rebinding in Chartbrew before 5.2.2 allows an authenticated user who can create or test API/data-source connections, and who controls DNS for the target hostname, to make the server reach internal services, localhost resources, or cloud metadata endpoints. The server validates the hostname with validateOutboundUrl() but the actual connection is performed by request-promise using an independent DNS lookup, so a public address can be returned during validation and a private address during the request. No public exploit identified at time of analysis; exploitation requires a credentialed account and attacker-controlled DNS plus winning the race between the two lookups, so real-world risk is moderate rather than high.
Joplin Server prior to 3.7.7 lets an authenticated low-privileged user who holds a *pending* (not yet accepted) folder-share invitation write new items directly into that shared folder, because ItemModel.checkIfAllowed() accepts any share_users row for the caller without requiring ShareUserStatus.Accepted. The injected content is then pushed out to the share owner and already-accepted participants by ShareModel.updateSharedItems3() before the attacker ever accepts the invitation, giving unauthorized content injection into another user's notebook. The flaw requires the invitation precondition, so it is not exploitable against arbitrary shares or default configurations with no pending invite; impact is integrity-only (CVSS 3.1 base 4.3, C:N/I:L/A:N, PR:L), no public exploit code was identified at time of analysis, and the issue is fixed in 3.7.7.
Server-side request forgery in CKAN MCP Server (ondata/@aborruso ckan-mcp-server) before version 0.4.108 allows an attacker who can influence the caller-supplied server_url parameter to force the server to issue requests to loopback addresses and to the cloud instance metadata service at 169.254.169.254. The flaw is the third bypass of the same validateServerUrl guard: because that guard only inspects the hostname string and never resolves DNS, any hostname that resolves to an internal address (documented examples lvh.me to 127.0.0.1 and *.nip.io to IMDS) slips through, and exploitation realistically requires prompt injection into content the victim's AI assistant processes while the MCP server is connected (CVSS UI:R). No confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis, though a proof-of-concept for an earlier, related SSRF variant in the same package is published; impact is highest for cloud-hosted deployments where IMDS returns IAM credentials.
HTTPS agent connection pooling in Node.js fails to distinguish PFX credentials when encoded as an object versus an array, enabling authentication bypass under specific mutual-TLS configurations. Affected are Node.js 22.x through 22.23.1, 24.x through 24.18.0, and 26.x through 26.5.0. A high-privileged local actor who controls HTTPS agent configuration can induce the runtime to reuse a TLS session authenticated with one PFX credential for a request that should require a different (or no) credential, undermining certificate-based identity verification. No public exploit or CISA KEV listing has been identified at time of analysis.
Node.js Permission Model fails to enforce filesystem write restrictions for the trace events subsystem, allowing a local attacker with low privileges to write files to paths explicitly blocked by the operator via the --experimental-permission flag. Rated Low severity (CVSS 3.3), this flaw affects Node.js 22.x through 22.23.1, 24.x through 24.18.0, and 26.x through 26.5.0, and is one of ten CVEs addressed in the July 2026 Node.js security release. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the fix is available in Node.js 26.5.1 released 2026-07-29.
TLS session resumption in Node.js fails to bind reusable sessions to the originally authenticated host, enabling an information disclosure pathway. Affected versions are Node.js 26.x prior to 26.3.1 (Current channel), as disclosed in the June 2026 security release. An attacker with low network-level privilege can cause a cached TLS session-established and authenticated against one hostname-to be reused for a distinct, attacker-influenced host, potentially bypassing host-based authentication. No public exploit code or CISA KEV listing is present at time of analysis.
Response queue poisoning in Node.js http.Agent allows network-accessible attackers to corrupt the HTTP keep-alive connection pool via a TOCTOU race condition, causing responses to be delivered to the wrong request handler. Affected is Node.js v26.x prior to v26.3.1, as disclosed in the June 2026 security release. Exploitation requires high attack complexity due to the race window, and no public exploit has been identified at time of analysis; this is rated Low severity (CVSS 3.7) by the Node.js team.
Improper hostname normalization in Node.js TLS server-identity verification (fixed in v26.3.1) lets a TLS peer's hostname be evaluated without proper Unicode/case normalization, so identity checks may match a host they should reject. Rated High by the Node.js team (CVSS 7.7, scope-changed, confidentiality-only), it can cause a client to trust the wrong server and expose data carried over the connection. No public exploit identified at time of analysis; this was disclosed pre-NVD via the nodejs/node June 2026 security release and is not listed in CISA KEV.
Node.js permission model bypass via FileHandle.utimes() allows local low-privilege users to modify file timestamps on paths outside their permitted write scope. Affecting Node.js 26.x before v26.3.1, this flaw is only exploitable when the experimental permission model is explicitly enabled via --experimental-permission, substantially limiting exposure. No public exploit code or active exploitation has been identified at time of analysis, and the vendor-released patch (v26.3.1) is confirmed available as of 2026-06-18.
TLS SNI context matching in Node.js performs case-sensitive hostname comparison, enabling network-accessible low-privileged attackers to bypass intended server-side TLS context selection by varying the casing of the SNI hostname in a ClientHello message. Affected versions prior to 26.3.1 may serve an incorrect TLS certificate or context when a client sends an SNI value with unexpected casing (e.g., 'EXAMPLE.COM' versus 'example.com'), yielding limited confidentiality and integrity impacts in multi-hostname deployments. No public exploit code or active exploitation has been identified; the fix shipped as part of the Node.js June 2026 coordinated security release alongside ten other CVEs.
Node.js Permission Model fails to apply net scope guards to pipe open and chmod operations, enabling a local authenticated user to bypass intended access control boundaries enforced by the experimental Permission Model. Affected is Node.js v26.x prior to v26.3.1 (Current release line), disclosed in the June 2026 security release. Rated Low severity by the Node.js team; no public exploit identified at time of analysis and not listed in CISA KEV.
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. [CVSS 7.5 HIGH]
Node.js has a permissions model bypass that allows attackers to circumvent --allow-fs-read and --allow-fs-write restrictions using alternate path representations.
Memory and availability pressure in the npm package qs (versions before 6.14.1) stems from an input-validation gap where the arrayLimit parse option is enforced for indexed array notation (a[0]=1) but not for bracket notation (a[]=1), letting attackers control how many array elements are materialized for a single key from an attacker-supplied query string. Exploitation requires a non-default configuration: the application must use qs to parse attacker-controlled query strings with parseArrays enabled (the default) and, critically, parameterLimit explicitly raised well above its default of 1000, because parameterLimit independently caps total parsed parameters and neutralizes the issue under default settings. Unauthenticated remote attackers face no user interaction, but impact is bounded to low availability/memory pressure rather than code execution; publicly available exploit code exists (PoC in vendor advisory GHSA-6rw7-vpxm-498p), a vendor patch is available in qs 6.14.1, and EPSS is only 0.45% (37th percentile), consistent with the vendor's own severity downgrade.
Cached HTTP responses can be served to the wrong authenticated user in axios-cache-interceptor before 1.11.1, leaking data across sessions and bypassing authorization checks in server-side deployments. The library builds its cache key from the request URL alone and ignores the upstream's `Vary: Authorization` response header, so when a backend, proxy, or API serves multiple users with different bearer tokens through a single cache instance, an authenticated attacker holding a valid low-privileged token (CVSS PR:L) who requests the same URL can receive another user's cached response; exploitation is timing- and configuration-dependent because the victim's response must already be cached. Publicly available exploit code exists (a full proof-of-concept is published in the GitHub advisory), while EPSS is low at 0.32% (22nd percentile) and CISA KEV does not list this issue, making this a genuine but conditional authorization-bypass flaw of moderate rather than urgent risk.
Prototype pollution in apidoc-core 0.2.0 and all later versions lets an attacker who can influence the data structures parsed by the library corrupt JavaScript object prototypes through a crafted 'define' property handled by the preProcess() function, potentially causing denial of service or unexpected behavior in the consuming application. The affected parsing is typically applied to developer-authored API annotation comments, which are trusted build-time inputs; real risk only materializes when an integrating application feeds untrusted or externally-supplied data into this parser. No public exploit identified at time of analysis, and no confirmed active exploitation (no KEV listing); the supplied CVSS 4.0 score of 9.3 (network, unauthenticated, high CIA impact) is not supported by the independent assessment, which rates the issue as a local-vector, low-integrity and low-availability impact flaw rather than a confirmed remote compromise.
Unsafe deserialization in React Server Components Server Function endpoints allows remote unauthenticated attackers to trigger an infinite loop that hangs the server process and can prevent subsequent HTTP requests from being served. The flaw affects React 19.0.2, 19.1.3, and 19.2.2 - including Next.js applications on Node.js that expose Server Functions (Server Actions) - and it represents an incomplete fix for CVE-2025-55184. EPSS is 19.99% (97th percentile), and no public exploit identified at time of analysis; CISA KEV does not list it as confirmed actively exploited.
Unvalidated reflection of the X-Forwarded-Host header in Astro (versions before 5.14.3) lets remote, unauthenticated attackers control the host value returned by the Astro.url property, which can be abused for canonical-link manipulation, redirecting credentials submitted through login or registration form URLs, and - when a caching proxy is in front - poisoning cached pages for subsequent users. Only deployments running Astro in on-demand/dynamic (SSR) rendering mode through a server adapter such as the Node adapter, behind a proxy that forwards the attacker-supplied X-Forwarded-Host header, and whose code actually consumes Astro.url are affected; statically generated Astro sites are not. Publicly available exploit code exists (the GitHub advisory includes a working curl PoC and a reference repository), but the issue is not listed in CISA KEV and EPSS is low at 0.41% (33rd percentile), with the independent assessment treating it as a moderate, context-dependent integrity risk rather than an emergency.
A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Command injection via Windows CreateProcess argument parsing affects multiple language runtimes and tooling (Node.js, PHP, Rust, Haskell process library, yt-dlp) that wrap the API without compensating for its quirks. Remote attackers can smuggle additional commands through arguments passed to child processes when applications spawn batch files or otherwise rely on CreateProcess's implicit cmd.exe handling. Publicly available exploit code exists and EPSS of 7.09% (92nd percentile) signals elevated, though not confirmed in-the-wild, exploitation interest; this CVE is not listed in CISA KEV.
A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install Node.js using the .msi installer. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
`fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An untrusted search path vulnerability exists in Node.js. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity.
A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
Undici is an HTTP/1.1 client for Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required.
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 20.6%.
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 83.2%.
Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity.
A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to. Rated medium severity (CVSS 5.6), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required.
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
The X.509 GeneralName type is a generic type for representing different types of names. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.