Node.js
Monthly
srvx's FastURL pathname parser on Node.js can be bypassed to circumvent route-based middleware (authentication guards, rate limiters) when absolute URIs with non-standard schemes are sent in raw HTTP requests. An attacker sending a crafted request like `GET file://hehe?/internal/run HTTP/1.1` can cause the router to match a different pathname than what downstream middleware sees after a deoptimization occurs, allowing access to protected endpoints. This affects srvx versions prior to 0.11.13, requires direct HTTP request capability (not browser-accessible), and has a CVSS score of 4.8 with medium complexity attack requirements. No public exploit identified at time of analysis.
YAML parsing in Node.js and Apple products fails to enforce recursion depth limits, allowing an attacker to trigger a stack overflow with minimal input (2-10 KB of nested flow sequences) that crashes the application with an uncaught RangeError. Applications relying solely on YAML-specific exception handling may fail to catch this error, potentially leading to process termination or service disruption. A patch is available for affected versions.
Parse Server versions prior to 8.6.60 and 9.6.0-alpha.54 contain a race condition vulnerability that allows attackers to reuse single-use MFA recovery codes an unlimited number of times through concurrent login requests. An attacker with knowledge of a user's password and possession of one valid recovery code can bypass the intended single-use restriction by sending multiple authentication attempts simultaneously within milliseconds, effectively defeating the multi-factor authentication protection mechanism. This vulnerability is tracked as CWE-367 (TOCTOU race condition) and has been patched in the aforementioned versions with fixes available via pull requests 10275 and 10276.
Vikunja Desktop (Electron wrapper) versions 0.21.0 through 2.1.x contain a critical remote code execution vulnerability caused by enabled Node.js integration combined with missing navigation controls. An attacker who is a legitimate user on a shared Vikunja instance can inject a malicious hyperlink into user-generated content (task descriptions, comments, project descriptions) that, when clicked by a victim using Vikunja Desktop, causes arbitrary code execution with the victim's OS user privileges. A proof-of-concept demonstrating command execution via a simple HTML link has been documented, and the vulnerability affects all Desktop users on affected versions.
The Vikunja Desktop Electron wrapper enables Node.js integration in the renderer process without proper context isolation or sandboxing, allowing any cross-site scripting vulnerability in the web frontend to escalate directly to remote code execution on the victim's machine. Vikunja versions 0.21.0 through 2.1.x are affected, as confirmed by CPE cpe:2.3:a:go-vikunja:vikunja. An attacker exploiting an XSS flaw gains full access to Node.js APIs and the underlying operating system, making this a critical privilege escalation from web-based XSS to system-level RCE.
WPGraphQL prior to version 2.10.0 allows authenticated low-privileged users to bypass comment moderation controls and self-approve their own comments without possessing the moderate_comments capability. The vulnerability exploits owner-based authorization logic in the updateComment mutation, enabling non-moderator users to transition comment status to APPROVE, HOLD, SPAM, or TRASH states directly. A proof-of-concept demonstrating this authorization bypass in WPGraphQL 2.9.1 has been published, and while the EPSS score of 0.03% indicates low statistical likelihood of exploitation, the attack vector is network-based with low complexity and requires only low-level user privileges (including custom roles with zero capabilities).
Uptime Kuma versions 1.23.0 through 2.2.0 contain an incomplete Server-Side Template Injection (SSTI) vulnerability in the LiquidJS templating engine that allows authenticated attackers to read arbitrary files from the server. A prior fix (GHSA-vffh-c9pq-4crh) attempted to restrict file path access through three mitigation options (root, relativeReference, dynamicPartials), but this fix only blocks quoted paths; attackers can bypass the mitigation by using unquoted absolute paths like /etc/passwd that successfully resolve through the require.resolve() fallback mechanism in liquid.node.js. The vulnerability requires low privileges (authenticated access) but can result in high confidentiality impact, making it a notable information disclosure risk for self-hosted monitoring deployments.
Node.js authentication bypass allows unauthenticated account creation when empty authData objects bypass credential validation, enabling attackers to establish authenticated sessions without providing required usernames or passwords. This affects applications where anonymous registration is disabled but authentication checks fail to properly validate the authData parameter. The vulnerability is fixed by treating empty authData as absent data and enforcing mandatory credential validation during user registration.
SandboxJS 0.8.34 contains a race condition where a shared global tick state allows concurrent sandboxes to interfere with each other's execution quotas during timer callback compilation. An attacker in a multi-tenant environment can exploit this to bypass resource limits and exhaust CPU/memory on the host system. A patch is available.
LibreChat versions prior to 0.8.3-rc1 contain a Denial of Service vulnerability in the DELETE /api/convos endpoint where authenticated attackers can crash the Node.js server process by sending malformed requests lacking the required req.body.arg parameter. The vulnerability exploits improper destructuring without validation, causing an unhandled TypeError that bypasses Express middleware and triggers process.exit(1), resulting in complete service unavailability. No evidence of active exploitation in the wild or public POC has been identified at this time.
Node.js Undici's response deduplication feature accumulates response bodies in memory instead of streaming them, allowing remote attackers to trigger denial of service through large or concurrent responses from untrusted endpoints. Applications using the deduplicate() interceptor are vulnerable to out-of-memory crashes when processing large or chunked responses. No patch is currently available.
CRLF injection in undici's HTTP upgrade handling allows authenticated attackers to inject arbitrary headers and perform request smuggling attacks against backend services like Redis and Elasticsearch when user input is passed unsanitized to the upgrade option. The vulnerability stems from insufficient validation of the upgrade parameter before writing to the socket, enabling attackers to terminate HTTP requests prematurely and route malicious data to non-HTTP protocols. This requires prior authentication and user interaction, with no patch currently available.
Parse Server's OAuth2 authentication adapter fails to properly validate app IDs when appidField and appIds are configured, allowing attackers to bypass authentication restrictions or cause login failures depending on the introspection endpoint's response handling. Deployments using this specific OAuth2 configuration are vulnerable to authentication bypass if the endpoint accepts malformed requests. A patch is available in versions 9.6.0-alpha.13 and 8.6.39.
Denial of service in yauzl 3.2.0 (Node.js zip parsing library) allows remote attackers to crash applications by submitting malformed zip files with specially crafted NTFS timestamp fields that trigger an out-of-bounds buffer read. The vulnerability affects any Node.js application that processes untrusted zip uploads and extracts file modification dates. No patch is currently available.
### Impact An attacker with access to the master key can inject malicious SQL via crafted field names used in query constraints when Parse Server is configured with PostgreSQL as the database. The field name in a `$regex` query operator is passed to PostgreSQL using unparameterized string interpolation, allowing the attacker to manipulate the SQL query. While the master key controls what can be done through the Parse Server abstraction layer, this SQL injection bypasses Parse Server entirely and operates at the database level. This vulnerability only affects Parse Server deployments using PostgreSQL. ### Patches The fix applies proper SQL identifier escaping to field names in the query handler and hardens query field name validation to reject malicious field names for all query types. ### Workarounds There is no known workaround. ### References - GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-c442-97qw-j6c6 - Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.10 - Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.36
Parse Server versions before 8.6.34 and 9.6.0-alpha.8 leak user registration status through differential error responses on the email verification endpoint, enabling attackers to enumerate valid email addresses in the system when email verification is enabled. Deployments with verifyUserEmails set to true are vulnerable to this user enumeration attack, which allows an attacker to systematically identify registered accounts by analyzing response codes from the /verificationEmailRequest endpoint. No patch is currently available for affected installations.
Parse Server's TOTP-based multi-factor authentication fails to invalidate recovery codes after use, allowing an attacker with a single recovery code to authenticate repeatedly as an affected user. This vulnerability impacts Parse Server deployments prior to versions 9.6.0-alpha.7 and 8.6.33, where recovery codes intended as single-use fallback mechanisms can be exploited indefinitely to bypass MFA protections. No patch is currently available for affected versions.
Stored XSS in Parse Server prior to versions 9.6.0-alpha.4 and 8.6.30 allows unauthenticated attackers to upload files with dangerous extensions (such as .svgz, .xht, .xml) that bypass default upload filters and execute malicious scripts in users' browsers within the Parse Server domain. Successful exploitation enables attackers to steal session tokens, hijack user accounts, or perform unauthorized actions on behalf of victims. User interaction is required to trigger the vulnerability when victims access the uploaded malicious files.
Denial of service in file-type library versions prior to 21.3.1 allows remote attackers to hang Node.js event loops by submitting malformed ASF (WMV/WMA) files that trigger infinite loops during file type detection. Applications using file-type to analyze untrusted input are vulnerable, with a minimal 55-byte payload sufficient to stall processing. No patch is currently available for affected Node.js and File Type products.
Parse Server versions prior to 9.5.2-alpha.6 and 8.6.19 allow authenticated users to bypass field protection checks by nesting query constraints within logical operators, enabling unauthorized extraction of protected field values. This vulnerability affects all Parse Server deployments with default protected fields, as the validation mechanism only inspects top-level query keys. A patch is available in the specified versions.
Parse Server versions prior to 9.5.2-alpha.4 and 8.6.17 allow authenticated users to upload SVG files containing malicious JavaScript that executes in the server's origin context due to missing content security headers, enabling attackers to steal session tokens and compromise user accounts. All deployments with file upload enabled for authenticated users are vulnerable by default, as the file extension filter blocks HTML but not SVG files. A patch is available in the specified versions.
Parse Server versions prior to 8.6.12 and 9.5.1-alpha.1 allow attackers to bypass the requestKeywordDenylist security control by nesting prohibited keywords within objects or arrays in request payloads, enabling injection of restricted data into applications. This logic flaw affects all Parse Server deployments since the denylist is enabled by default, and custom keyword restrictions configured by developers are equally vulnerable to the same bypassing technique. Attackers can exploit this to inject malicious content or bypass access controls on any Parse Server instance.
Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Vaadin 14.2.0 versions up to 14.14.0 is affected by path traversal.
node-tar is a full-featured Tar for Node.js.
Parse Server versions 9.3.1-alpha.3 through 9.5.0-alpha.9 allow unauthenticated attackers to bypass GraphQL introspection restrictions by nesting __type queries within inline fragments, enabling unauthorized schema reconnaissance. An attacker can exploit this to enumerate available types and fields in the GraphQL API despite the graphQLPublicIntrospection control being disabled. The vulnerability affects Parse Server deployments running on Node.js and has been patched in version 9.5.0-alpha.10.
Parse Server versions prior to 8.6.9 and 9.5.0-alpha.9 fail to enforce file access control triggers on the metadata endpoint, allowing unauthenticated attackers to retrieve sensitive file metadata that should be restricted. This bypass occurs because beforeFind and afterFind triggers are not invoked when accessing file metadata, circumventing security gates intended to protect file information. Affected organizations using Parse Server without the patched versions face unauthorized disclosure of file metadata.
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. [CVSS 3.7 LOW]
Parse Server versions prior to 8.6.7 and 9.5.0-alpha.6 expose sensitive database information through unfiltered error responses when processing malformed regex queries. An unauthenticated attacker can craft specially crafted query parameters to leak database internals including error messages, cluster details, and topology information. Patches are available for affected versions.
Parse Server versions before 8.6.5 and 9.5.0-alpha.3 allow the readOnlyMasterKey to perform write and delete operations on files, violating the intended read-only access restriction. An authenticated attacker with the readOnlyMasterKey can upload arbitrary files or delete existing files via the Files API on affected deployments. No patch is currently available for this medium-severity vulnerability that impacts organizations using Parse Server with exposed file endpoints.
Dark Reader is an accessibility browser extension that makes web pages colors dark. The dynamic dark mode feature of the extension works by analyzing the colors of web pages found in CSS style sheet files. [CVSS 3.4 LOW]
Authentication bypass in FUXA SCADA/HMI system 1.2.8 and prior leading to Remote Code Execution. Unauthenticated attackers can execute arbitrary code on industrial control HMI systems. EPSS 0.64% with PoC available.
Email content leakage in Lettermint Node.js SDK versions 1.5.0 and below allows local authenticated users to intercept sensitive email data when a single client instance sends multiple messages, as email properties are not properly cleared between sends. Applications using transactional email flows with reused client instances risk exposing recipient addresses and message content to unintended parties. The vulnerability has been patched in version 1.5.1.
farmfe/core versions up to 1.7.6 contains a vulnerability that allows attackers to surveil developers running Farm who visit their webpage and steal source code th (CVSS 6.5).
### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. [CVSS 3.7 LOW]
Client-certificate-auth middleware for Node.js versions 0.2.1 and 0.3.0 fails to validate the Host header when redirecting HTTP requests to HTTPS, enabling attackers to craft malicious redirects that direct users to arbitrary domains. Public exploit code exists for this open redirect vulnerability, and no patch is currently available for affected versions.
@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the...
n8n is an open source workflow automation platform. From version 1.65.0 to before 1.114.3, the use of Buffer.allocUnsafe() and Buffer.allocUnsafeSlow() in the task runner allowed untrusted code to allocate uninitialized memory. [CVSS 7.7 HIGH]
Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.3, a denial-of-service vulnerability in Fastify’s Web Streams response handling can allow a remote client to exhaust server memory. Applications that return a ReadableStream (or Response with a Web Stream body) via reply.send() are impacted. A slow or non-reading client can trigger unbounded buffering when backpressure is ignored, leading to process crashes or severe degradation. This issue has been patched in...
jsPDF versions prior to 4.1.0 contain a race condition in the addJS method where a shared module-scoped variable is overwritten during concurrent PDF generation, causing JavaScript payloads and embedded data intended for one user to be included in another user's generated PDF. This cross-user data leakage primarily affects server-side Node.js deployments handling simultaneous requests, allowing attackers to access sensitive information leaked across user sessions. Public exploit code exists for this vulnerability.
Backstage TechDocs plugin versions prior to 1.13.11 and 1.14.1 contain a path traversal vulnerability that allows authenticated attackers to read arbitrary files from the host filesystem when the local generator is enabled. The vulnerability stems from insufficient symlink validation during the documentation build process, enabling attackers to embed sensitive file contents into generated HTML accessible to documentation viewers. Organizations using `techdocs.generator.runIn: local` with untrusted documentation sources are at risk until patching to the fixed versions.
The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability. This occurs because the logfile variable is not properly sanitized in lib/Local.js. [CVSS 7.8 HIGH]
Bun versions prior to 1.3.5 allow attackers to bypass the trusted dependencies allowlist by creating non-npm packages with names matching legitimate packages, enabling potential code execution through dependency confusion attacks. This local vulnerability affects systems using Bun's package management where an attacker can craft malicious packages with identical names to trusted dependencies. No patch is currently available for affected Node.js and GitHub integrations.
pnpm versions before 10.28.2 fail to validate the `directories.bin` field during package processing, allowing malicious packages to use path traversal (e.g., `../../../../tmp`) to escape the package root and chmod 755 files at arbitrary locations on Unix-like systems. Public exploit code exists for this vulnerability. The issue affects Linux, macOS, and Node.js environments but not Windows due to platform-specific protections.
pnpm versions prior to 10.28.2 fail to properly constrain symlink resolution when installing file: and git: dependencies, allowing malicious packages to copy sensitive files from the host system into node_modules and leak credentials. This affects developers using local file dependencies and CI/CD pipelines installing git-based packages, with public exploit code available. The vulnerability enables theft of credentials from locations like ~/.ssh/id_rsa and ~/.npmrc by exploiting symlinks to absolute paths outside the package root.
Pnpm versions up to 10.28.1 contains a vulnerability that allows attackers to overwriting config files, scripts, or other sensitive files (CVSS 6.5).
Path traversal in pnpm's tarball extraction on Windows allows attackers to write files outside the intended package directory by exploiting incomplete path normalization that fails to block backslash-based traversal sequences. Public exploit code exists for this vulnerability, which affects Windows developers and CI/CD pipelines (GitHub Actions, Azure DevOps) and could result in overwriting sensitive configuration files like .npmrc or build configurations. A patch is available in pnpm version 10.28.1 and later.
Path traversal in pnpm's binary fetcher (versions prior to 10.28.1) allows attackers to write files outside the intended extraction directory through malicious ZIP entries or crafted prefix values, potentially overwriting critical configuration files and scripts on affected systems. All pnpm users installing packages with binary assets are vulnerable, particularly those in CI/CD pipelines or with custom Node.js binary configurations. Public exploit code exists for this medium-severity vulnerability.
A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-Resume: 1` header and processes attacker-controlled postponed state data. [CVSS 5.9 MEDIUM]
Openfire 4.6.0 contains a stored cross-site scripting vulnerability in the nodejs plugin that allows attackers to inject malicious scripts through the 'path' parameter. [CVSS 6.4 MEDIUM]
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. [CVSS 7.5 HIGH]
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. [CVSS 7.5 HIGH]
A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. [CVSS 7.5 HIGH]
A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. [CVSS 5.3 MEDIUM]
A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. [CVSS 7.1 HIGH]
Node.js has a permissions model bypass that allows attackers to circumvent --allow-fs-read and --allow-fs-write restrictions using alternate path representations.
Unsafe code generation in binary-parser prior to version 2.3.0 allows remote code execution when processing untrusted input for parser field names or encoding parameters. Node.js applications using vulnerable versions of the library can be compromised to execute arbitrary JavaScript with process-level privileges. A patch is available and exploitation requires no authentication or user interaction.
Symlink poisoning via race condition in node-tar up to version 7.5.3 allows attackers to exploit Unicode normalization on case-insensitive filesystems like macOS APFS, where the path reservation system fails to serialize operations on colliding paths. Public exploit code exists for this vulnerability, enabling concurrent processing that bypasses internal safeguards. Node.js users and applications depending on vulnerable tar versions should update immediately, as attackers can leverage this to manipulate file operations during archive extraction.
Undici versions up to 7.18.0 is affected by allocation of resources without limits or throttling (CVSS 5.9).
Ghost is a Node.js content management system. In versions 5.38.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost’s media inliner mechanism allows staff users in possession of a valid authentication token for the Ghost Admin API to exfiltrate data from internal systems via SSRF. [CVSS 2.7 LOW]
SQL injection in Ghost's Admin API members/events endpoint enables authenticated administrators to execute arbitrary database queries, affecting versions 5.90.0-5.130.5 and 6.0.0-6.10.3. An attacker with valid Admin API credentials could exploit this to extract, modify, or delete sensitive data stored in the Ghost database. Patches are available in versions 5.130.6 and 6.11.0.
A weakness has been identified in carboneio carbone up to fbcd349077ad0e8748be73eab2a82ea92b6f8a7e. This impacts an unknown function of the file lib/input.js of the component Formatter Handler. [CVSS 5.0 MEDIUM]
Local file inclusion and path traversal in the Node.js builds of jsPDF (dist/jspdf.node.js and dist/jspdf.node.min.js) prior to version 4.0.0 lets an attacker who controls the path argument passed to loadFile, addImage, html, or addFont read arbitrary files from the host filesystem, with the file contents embedded verbatim into the generated PDF. Applications that forward unsanitized user input into these methods leak secrets such as /etc/passwd, configuration files, or private keys to anyone who can request a PDF. No public exploit identified at time of analysis; EPSS risk is very low (0.02%, 6th percentile) and the issue is not in CISA KEV.
Signal K Server releases before 2.19.0 let an unauthenticated remote attacker submit a device access request whose attacker-controlled `description` field reads like a benign read-only request while the `permissions` field actually asks for `admin`; the pre-2.19.0 admin UI displays the description prominently and the authoritative permission level less visibly. The same access-request handler trusts the client-supplied `X-Forwarded-For` header without validation, so the source IP shown to the approving administrator can be spoofed to look like a trusted internal address, and chaining this with the accompanying device/source-name information disclosure produces a convincing social-engineering scenario. Publicly available exploit code exists, but the attack is not confirmed actively exploited (CISA KEV is absent) and EPSS is only 0.02% (6th percentile) because a human administrator must manually approve the request (UI:R); Internet-reachable Signal K servers are the highest-risk deployments and the vendor explicitly urges immediate upgrade.
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore interface allow administrators to install npm packages through a REST API endpoint. [CVSS 7.2 HIGH]
Unauthenticated server state pollution in Signal K Server prior to version 2.19.0 lets a network-reachable attacker overwrite the module-global restoreFilePath via the unauthenticated /skServer/validateBackup endpoint, hijacking the administrator's Restore workflow so that attacker-supplied archive contents are written over critical configuration files such as security.json. Overwriting security.json allows creation of a rogue administrator account, which the attacker can then use to reach a separate command-injection flaw in the App Store install path and achieve remote code execution. Publicly available exploit code exists and the vendor explicitly warns Internet-exposed instances to patch immediately, though EPSS remains low at roughly 0.10% (27th percentile); no confirmed active exploitation (CISA KEV) is associated with this issue at time of analysis.
Remote code execution in Titra time-tracking software prior to version 0.99.49 allows an authenticated Admin user to inject arbitrary JavaScript through the global 'timeEntryRule' setting, which is passed unsanitized into a NodeVM sandbox and executed on the server. Because the weakness sits behind the admin login boundary (CVSS vector PR:H), a non-admin or unauthenticated attacker cannot reach the vulnerable setting, but any holder of an Admin account achieves full confidentiality, integrity, and availability impact across the host - worsened in default Docker deployments where the process historically ran as root. Publicly available exploit code exists and the vendor has released a fix in 0.99.49, so this should be treated as a high-priority patch for internet-exposed instances with multiple administrators.
Authentication and authorization bypass in NestJS affects only applications served through the Fastify adapter: @nestjs/platform-fastify versions prior to 11.1.11 fail to execute route-scoped middleware when a request path contains percent-encoded characters, so an unauthenticated remote attacker who requests /%61dmin instead of /admin reaches the protected controller while the middleware that was supposed to guard it is silently skipped. The flaw is conditional - the application must use @nestjs/platform-fastify, must enforce a security check (authentication, authorization, or input validation) inside a NestMiddleware wired through MiddlewareConsumer or app.use(), and must scope that middleware to specific string paths or controllers such as .forRoutes('admin'); globally applied middleware and the default Express platform are not bypassed. Publicly available exploit code exists, and the CVSS 4.0 base score is 6.9 with an independent assessment of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N (unauthenticated, no user interaction, high confidentiality and integrity impact); there is no indication of confirmed active exploitation (not listed in CISA KEV).
OS command injection in the systeminformation Node.js library on Windows allows arbitrary PowerShell command execution when attacker-controlled input reaches the optional `drive` parameter of the fsSize() function. Versions prior to 5.27.14 are affected, but exploitability is conditional: the Node.js process must be running on Windows (win32) and the host application must actually forward user-supplied drive or volume values into fsSize() - applications that call the function with no argument or with hardcoded values, and all non-Windows deployments, are not vulnerable. Publicly available exploit code exists (published alongside advisory GHSA-wphj-fx3q-84ch), though no confirmed active exploitation (CISA KEV) has been reported at time of analysis; the CVSS base score is 8.1 with AC:H precisely because the attack hinges on application data flow rather than a trivially reachable endpoint. Unauthenticated at the library level (PR:N), remote delivery is possible when the vulnerable function is reachable through a web or API surface.
Reflected cross-site scripting in Parse Server's password reset and email verification HTML pages lets unauthenticated remote attackers inject arbitrary script into pages served by the Pages Router by placing a payload in the token, username, or locale query parameter, which the server reflects unescaped back into the response; affected releases are all versions prior to 8.6.1 and the 9.x pre-releases from 9.0.0 up to (but not including) 9.1.0-alpha.3. Because the flaw is reflected rather than stored, exploitation requires a victim to be socially engineered into clicking a crafted link (CVSS UI:R), after which script executes in the victim's browser context with limited confidentiality and integrity impact - no server-side compromise occurs. EPSS is a low 0.22% (11th percentile), this CVE is not in CISA KEV, and no public exploit code has been identified at time of analysis; the assessed risk is moderate rather than high priority.
Challenge payload splicing in the ALTCHA proof-of-work bot-protection libraries lets remote, unauthenticated attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) reuse a previously solved challenge past its intended expiration by reinterpreting a valid HMAC-signed payload with an altered 'expires' parameter. Only deployments that trust the signed payload's embedded expiration without independently tracking consumed challenges are affected; the vendor explicitly conditions impact on 'server-side replay handling and deployment assumptions.' Impact is confined to abuse-prevention controls such as rate limiting and bot mitigation with no effect on data confidentiality or integrity (C:N/I:L/A:L), CISA KEV does not list this issue, no public exploit code has been identified at time of analysis, and the EPSS score of 0.46% (38th percentile) indicates low predicted exploitation activity.
Denial of service in the npm package Servify Express (servify-express) versions 1.1 and earlier allows unauthenticated remote attackers to exhaust server memory and degrade or crash the Node.js process by sending extremely large JSON request bodies to applications that rely on the library's default express.json() configuration without an explicit size limit. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a network-reachable, no-authentication, no-user-interaction availability impact, though exploitation depends on the deployment being internet-facing and not already protected by a body-size limit, rate limiting, or a reverse proxy such as NGINX. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); EPSS is low at 0.07% (21st percentile), and the vendor-released fix is version 1.2.
Confidentiality and integrity of the Parse Server project's own GitHub Actions CI/CD pipeline are at risk because the repository's ci-performance.yml workflow used the 'pull_request_target' trigger while holding write permissions (pull-requests: write, issues: write) and access to repository secrets, allowing code supplied by an external fork - or its lifecycle scripts - to execute inside the privileged base-repository context. Only the project's automation infrastructure, including public forks with GitHub Actions enabled, is exposed; deployed Parse Server instances are unaffected. Exploitation of this CI/CD supply-chain weakness has not been observed in the wild (no public exploit identified at time of analysis), and overall risk is low given a 0.42% EPSS score (34th percentile), though the flaw is rated 6.9 under both CVSS v4.0 and the independently assessed CVSS v3.1 vector. Remote, unauthenticated attackers who can open a pull request from a fork are the threat model; vendor-released fixes exist in 8.6.0-alpha.2 and the commits 6b9f896 and e3d27fe.
Unauthenticated remote attackers can bypass path-based authorization in Form.io 3.5.6 and earlier and 4.0.0-rc.1 through 4.4.2 to read data from protected API endpoints via a crafted request path that exploits improper case handling (CWE-178). This is a confidentiality-only issue affecting deployments that rely on the vulnerable path-matching logic for API protection, with no integrity or availability impact indicated. No public exploit code was identified at time of analysis (EPSS 0.31%, 22nd percentile), and vendor-released fixes are available in Form.io 3.5.7 and 4.4.3.
Concurrent token requests handled by the Auth0 Next.js SDK can be resolved through an internal in-flight request cache to the wrong result, causing an application that uses a singleton Auth0 client to receive an access token belonging to a different, simultaneously executed request - an incorrect-authorization and confidentiality exposure tracked as CWE-863. Only @auth0/nextjs-auth0 versions 4.11.0, 4.11.1, and 4.12.0 are affected; releases 4.11.2 and 4.12.1 remove the faulty TokenRequestCache. Exploitation is gated on winning a non-deterministic concurrency race (AC:H) by an authenticated user of the application (PR:L), the EPSS score is only 0.20% (9th percentile), and no public exploit has been identified at time of analysis.
auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected header or payload in HMAC secret lookup routines, which can allow attackers to bypass signature verification. This issue has been patched in versions 3.2.3 and 4.0.1.
Sentry-Javascript is an official Sentry SDKs for JavaScript. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
esm.sh is a nobuild content delivery network(CDN) for modern web development. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Astro is a web framework. Rated low severity (CVSS 3.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
npm package `expr-eval` is vulnerable to Prototype Pollution. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Socket Firewall is an HTTP/HTTPS proxy server that intercepts package manager requests and enforces security policies by blocking dangerous packages. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
node-tar 7.5.1 can leak uninitialized process memory into the caller's data stream when the synchronous listing API `.t()` / `.list()` is used with `{ sync: true }` and the tar file on disk is truncated to a smaller size mid-read. A local attacker (or any concurrent process with write access to the archive) must win a narrow race window between the initial size lookup and the parser's read of a truncated 512-byte block boundary, after which the parser can hand back bytes of stale heap memory - potentially unrelated file contents, environment variables, or credentials - instead of tar entry data. Real-world risk is limited: the vector is local (CVSS:3.1/AV:L/AC:H/PR:L/UI:R, CVSS 4.0 base 6.1), EPSS is only 0.13% (3rd percentile), the vulnerability is not in CISA KEV, and a publicly available proof-of-concept reproducer exists in the GitHub advisory (GHSA-29xp-372q-xqph) targeting Node.js 22 or >= 25.1.0; the issue is fixed in 7.5.2.
An open redirect in Koa's ctx.back() helper lets remote, unauthenticated attackers force a victim's browser to an attacker-controlled site by sending a crafted Referer header containing a protocol-relative URL such as '//evil.com/login/'. Koa.js versions 2.16.2 up to (but not including) 2.16.3 and 3.0.1 up to (but not including) 3.0.3 are affected; the flaw is a bypass of the earlier fix for CVE-2025-8129/CVE-2025-54420. Publicly available exploit code and a proof-of-concept exist, but EPSS is low (0.29%, 20th percentile) and there is no confirmed active exploitation (not in CISA KEV); exploitation requires user interaction because the victim must trigger the back-redirect flow, and impact is limited to phishing/social-engineering-style redirection rather than server compromise.
Prototype pollution in happy-dom 19.0.0 through 20.0.1 allows attacker-controlled script to break out of the library's intended JavaScript sandbox and run arbitrary operating-system commands inside the host Node.js process. Exploitation requires the embedding application to enable JavaScript evaluation (settings.enableJavaScriptEvaluation: true) and to feed untrusted markup into a Browser/ServerRenderer instance - a non-default configuration, which is why real-world exposure is narrower than the raw score suggests. A working proof-of-concept payload is published in the vendor advisory (GHSA-qpm2-6cq5-7pq5), so publicly available exploit code exists; there is no CISA KEV listing, and EPSS is low (0.35%, ~27th percentile). The flaw is an incomplete fix for CVE-2025-61927 and is remediated in happy-dom 20.0.2.
Improper HTML stripping in the Mailgen Node.js package (versions through 2.0.31) allows attacker-controlled markup to survive Mailgen.generatePlaintext and be emitted in a string the API advertises as plaintext. Remote, unauthenticated attackers who can influence the values passed into generatePlaintext can embed a tag containing a Unicode line separator such as U+2028, which the pre-patch tag-stripping regex fails to match, and if that returned string is later rendered in an HTML context - an email preview or web view - the injected markup executes script in the victim's browser, with the victim having to view/render the content (UI:R). Impact is narrowly conditional (applications that consume the output strictly as plaintext are unaffected, which is why the vendor CVSS 4.0 score is only 2.9), no active exploitation is indicated (not listed in CISA KEV; EPSS 0.45%, 37th percentile), and the upstream advisory documents a proof-of-concept payload; version 2.0.32 fixes the flaw.
HTML injection in Mailgen through 2.0.30 can become XSS when the generatePlaintext() output is rendered as HTML; the flaw lets HTML-entity-encoded tags pass through the tag-stripping regex before he.decode() reactivates them. Exploitation is remote and unauthenticated per the CVSS vector (PR:N) but requires user interaction and the specific misuse of the intended plaintext string as HTML, and only applications passing user-generated content to generatePlaintext are affected. Publicly available exploit code exists, the issue is not confirmed actively exploited (no CISA KEV), EPSS is 0.43% (35th percentile), and the vendor-released fix is Mailgen 2.0.31.
VM context escape in Happy DOM 19.x and earlier allows attacker-controlled JavaScript executed inside a Window to break out of the Node.js VM context and reach process-level functionality; on CommonJS runtimes the escaped code can obtain the require() function, yielding arbitrary module import and full remote code execution, while on ESM the escape yields the process object without require/import. Because JavaScript evaluation is enabled by default in v19 and lower, any application that feeds untrusted HTML or script into a Window (document.write(), innerHTML, or server-side rendering of user-supplied content) is exposed without opting in, and untrusted code does not need to be executed by the victim deliberately. There is no confirmed active exploitation (CISA KEV) and no public exploit weaponization flagged, though the vendor advisory publishes working reproduction snippets; EPSS is low at 0.64% (49th percentile), and the vendor-released patch is Happy DOM 20.0.0, which disables JavaScript evaluation by default.
Authenticated users can upload arbitrary files to Flowise 3.0.7 due to missing validation, enabling persistent storage of Node.js web shells that can lead to remote code execution if triggered. The vulnerability requires low-privilege authentication (PR:L) and has a CVSS score of 8.8; publicly available exploit code exists. While the uploaded shells do not auto-execute, they can be leveraged through administrator error or chained vulnerabilities, posing a high threat to system integrity and confidentiality.
srvx's FastURL pathname parser on Node.js can be bypassed to circumvent route-based middleware (authentication guards, rate limiters) when absolute URIs with non-standard schemes are sent in raw HTTP requests. An attacker sending a crafted request like `GET file://hehe?/internal/run HTTP/1.1` can cause the router to match a different pathname than what downstream middleware sees after a deoptimization occurs, allowing access to protected endpoints. This affects srvx versions prior to 0.11.13, requires direct HTTP request capability (not browser-accessible), and has a CVSS score of 4.8 with medium complexity attack requirements. No public exploit identified at time of analysis.
YAML parsing in Node.js and Apple products fails to enforce recursion depth limits, allowing an attacker to trigger a stack overflow with minimal input (2-10 KB of nested flow sequences) that crashes the application with an uncaught RangeError. Applications relying solely on YAML-specific exception handling may fail to catch this error, potentially leading to process termination or service disruption. A patch is available for affected versions.
Parse Server versions prior to 8.6.60 and 9.6.0-alpha.54 contain a race condition vulnerability that allows attackers to reuse single-use MFA recovery codes an unlimited number of times through concurrent login requests. An attacker with knowledge of a user's password and possession of one valid recovery code can bypass the intended single-use restriction by sending multiple authentication attempts simultaneously within milliseconds, effectively defeating the multi-factor authentication protection mechanism. This vulnerability is tracked as CWE-367 (TOCTOU race condition) and has been patched in the aforementioned versions with fixes available via pull requests 10275 and 10276.
Vikunja Desktop (Electron wrapper) versions 0.21.0 through 2.1.x contain a critical remote code execution vulnerability caused by enabled Node.js integration combined with missing navigation controls. An attacker who is a legitimate user on a shared Vikunja instance can inject a malicious hyperlink into user-generated content (task descriptions, comments, project descriptions) that, when clicked by a victim using Vikunja Desktop, causes arbitrary code execution with the victim's OS user privileges. A proof-of-concept demonstrating command execution via a simple HTML link has been documented, and the vulnerability affects all Desktop users on affected versions.
The Vikunja Desktop Electron wrapper enables Node.js integration in the renderer process without proper context isolation or sandboxing, allowing any cross-site scripting vulnerability in the web frontend to escalate directly to remote code execution on the victim's machine. Vikunja versions 0.21.0 through 2.1.x are affected, as confirmed by CPE cpe:2.3:a:go-vikunja:vikunja. An attacker exploiting an XSS flaw gains full access to Node.js APIs and the underlying operating system, making this a critical privilege escalation from web-based XSS to system-level RCE.
WPGraphQL prior to version 2.10.0 allows authenticated low-privileged users to bypass comment moderation controls and self-approve their own comments without possessing the moderate_comments capability. The vulnerability exploits owner-based authorization logic in the updateComment mutation, enabling non-moderator users to transition comment status to APPROVE, HOLD, SPAM, or TRASH states directly. A proof-of-concept demonstrating this authorization bypass in WPGraphQL 2.9.1 has been published, and while the EPSS score of 0.03% indicates low statistical likelihood of exploitation, the attack vector is network-based with low complexity and requires only low-level user privileges (including custom roles with zero capabilities).
Uptime Kuma versions 1.23.0 through 2.2.0 contain an incomplete Server-Side Template Injection (SSTI) vulnerability in the LiquidJS templating engine that allows authenticated attackers to read arbitrary files from the server. A prior fix (GHSA-vffh-c9pq-4crh) attempted to restrict file path access through three mitigation options (root, relativeReference, dynamicPartials), but this fix only blocks quoted paths; attackers can bypass the mitigation by using unquoted absolute paths like /etc/passwd that successfully resolve through the require.resolve() fallback mechanism in liquid.node.js. The vulnerability requires low privileges (authenticated access) but can result in high confidentiality impact, making it a notable information disclosure risk for self-hosted monitoring deployments.
Node.js authentication bypass allows unauthenticated account creation when empty authData objects bypass credential validation, enabling attackers to establish authenticated sessions without providing required usernames or passwords. This affects applications where anonymous registration is disabled but authentication checks fail to properly validate the authData parameter. The vulnerability is fixed by treating empty authData as absent data and enforcing mandatory credential validation during user registration.
SandboxJS 0.8.34 contains a race condition where a shared global tick state allows concurrent sandboxes to interfere with each other's execution quotas during timer callback compilation. An attacker in a multi-tenant environment can exploit this to bypass resource limits and exhaust CPU/memory on the host system. A patch is available.
LibreChat versions prior to 0.8.3-rc1 contain a Denial of Service vulnerability in the DELETE /api/convos endpoint where authenticated attackers can crash the Node.js server process by sending malformed requests lacking the required req.body.arg parameter. The vulnerability exploits improper destructuring without validation, causing an unhandled TypeError that bypasses Express middleware and triggers process.exit(1), resulting in complete service unavailability. No evidence of active exploitation in the wild or public POC has been identified at this time.
Node.js Undici's response deduplication feature accumulates response bodies in memory instead of streaming them, allowing remote attackers to trigger denial of service through large or concurrent responses from untrusted endpoints. Applications using the deduplicate() interceptor are vulnerable to out-of-memory crashes when processing large or chunked responses. No patch is currently available.
CRLF injection in undici's HTTP upgrade handling allows authenticated attackers to inject arbitrary headers and perform request smuggling attacks against backend services like Redis and Elasticsearch when user input is passed unsanitized to the upgrade option. The vulnerability stems from insufficient validation of the upgrade parameter before writing to the socket, enabling attackers to terminate HTTP requests prematurely and route malicious data to non-HTTP protocols. This requires prior authentication and user interaction, with no patch currently available.
Parse Server's OAuth2 authentication adapter fails to properly validate app IDs when appidField and appIds are configured, allowing attackers to bypass authentication restrictions or cause login failures depending on the introspection endpoint's response handling. Deployments using this specific OAuth2 configuration are vulnerable to authentication bypass if the endpoint accepts malformed requests. A patch is available in versions 9.6.0-alpha.13 and 8.6.39.
Denial of service in yauzl 3.2.0 (Node.js zip parsing library) allows remote attackers to crash applications by submitting malformed zip files with specially crafted NTFS timestamp fields that trigger an out-of-bounds buffer read. The vulnerability affects any Node.js application that processes untrusted zip uploads and extracts file modification dates. No patch is currently available.
### Impact An attacker with access to the master key can inject malicious SQL via crafted field names used in query constraints when Parse Server is configured with PostgreSQL as the database. The field name in a `$regex` query operator is passed to PostgreSQL using unparameterized string interpolation, allowing the attacker to manipulate the SQL query. While the master key controls what can be done through the Parse Server abstraction layer, this SQL injection bypasses Parse Server entirely and operates at the database level. This vulnerability only affects Parse Server deployments using PostgreSQL. ### Patches The fix applies proper SQL identifier escaping to field names in the query handler and hardens query field name validation to reject malicious field names for all query types. ### Workarounds There is no known workaround. ### References - GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-c442-97qw-j6c6 - Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.10 - Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.36
Parse Server versions before 8.6.34 and 9.6.0-alpha.8 leak user registration status through differential error responses on the email verification endpoint, enabling attackers to enumerate valid email addresses in the system when email verification is enabled. Deployments with verifyUserEmails set to true are vulnerable to this user enumeration attack, which allows an attacker to systematically identify registered accounts by analyzing response codes from the /verificationEmailRequest endpoint. No patch is currently available for affected installations.
Parse Server's TOTP-based multi-factor authentication fails to invalidate recovery codes after use, allowing an attacker with a single recovery code to authenticate repeatedly as an affected user. This vulnerability impacts Parse Server deployments prior to versions 9.6.0-alpha.7 and 8.6.33, where recovery codes intended as single-use fallback mechanisms can be exploited indefinitely to bypass MFA protections. No patch is currently available for affected versions.
Stored XSS in Parse Server prior to versions 9.6.0-alpha.4 and 8.6.30 allows unauthenticated attackers to upload files with dangerous extensions (such as .svgz, .xht, .xml) that bypass default upload filters and execute malicious scripts in users' browsers within the Parse Server domain. Successful exploitation enables attackers to steal session tokens, hijack user accounts, or perform unauthorized actions on behalf of victims. User interaction is required to trigger the vulnerability when victims access the uploaded malicious files.
Denial of service in file-type library versions prior to 21.3.1 allows remote attackers to hang Node.js event loops by submitting malformed ASF (WMV/WMA) files that trigger infinite loops during file type detection. Applications using file-type to analyze untrusted input are vulnerable, with a minimal 55-byte payload sufficient to stall processing. No patch is currently available for affected Node.js and File Type products.
Parse Server versions prior to 9.5.2-alpha.6 and 8.6.19 allow authenticated users to bypass field protection checks by nesting query constraints within logical operators, enabling unauthorized extraction of protected field values. This vulnerability affects all Parse Server deployments with default protected fields, as the validation mechanism only inspects top-level query keys. A patch is available in the specified versions.
Parse Server versions prior to 9.5.2-alpha.4 and 8.6.17 allow authenticated users to upload SVG files containing malicious JavaScript that executes in the server's origin context due to missing content security headers, enabling attackers to steal session tokens and compromise user accounts. All deployments with file upload enabled for authenticated users are vulnerable by default, as the file extension filter blocks HTML but not SVG files. A patch is available in the specified versions.
Parse Server versions prior to 8.6.12 and 9.5.1-alpha.1 allow attackers to bypass the requestKeywordDenylist security control by nesting prohibited keywords within objects or arrays in request payloads, enabling injection of restricted data into applications. This logic flaw affects all Parse Server deployments since the denylist is enabled by default, and custom keyword restrictions configured by developers are equally vulnerable to the same bypassing technique. Attackers can exploit this to inject malicious content or bypass access controls on any Parse Server instance.
Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Vaadin 14.2.0 versions up to 14.14.0 is affected by path traversal.
node-tar is a full-featured Tar for Node.js.
Parse Server versions 9.3.1-alpha.3 through 9.5.0-alpha.9 allow unauthenticated attackers to bypass GraphQL introspection restrictions by nesting __type queries within inline fragments, enabling unauthorized schema reconnaissance. An attacker can exploit this to enumerate available types and fields in the GraphQL API despite the graphQLPublicIntrospection control being disabled. The vulnerability affects Parse Server deployments running on Node.js and has been patched in version 9.5.0-alpha.10.
Parse Server versions prior to 8.6.9 and 9.5.0-alpha.9 fail to enforce file access control triggers on the metadata endpoint, allowing unauthenticated attackers to retrieve sensitive file metadata that should be restricted. This bypass occurs because beforeFind and afterFind triggers are not invoked when accessing file metadata, circumventing security gates intended to protect file information. Affected organizations using Parse Server without the patched versions face unauthorized disclosure of file metadata.
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. [CVSS 3.7 LOW]
Parse Server versions prior to 8.6.7 and 9.5.0-alpha.6 expose sensitive database information through unfiltered error responses when processing malformed regex queries. An unauthenticated attacker can craft specially crafted query parameters to leak database internals including error messages, cluster details, and topology information. Patches are available for affected versions.
Parse Server versions before 8.6.5 and 9.5.0-alpha.3 allow the readOnlyMasterKey to perform write and delete operations on files, violating the intended read-only access restriction. An authenticated attacker with the readOnlyMasterKey can upload arbitrary files or delete existing files via the Files API on affected deployments. No patch is currently available for this medium-severity vulnerability that impacts organizations using Parse Server with exposed file endpoints.
Dark Reader is an accessibility browser extension that makes web pages colors dark. The dynamic dark mode feature of the extension works by analyzing the colors of web pages found in CSS style sheet files. [CVSS 3.4 LOW]
Authentication bypass in FUXA SCADA/HMI system 1.2.8 and prior leading to Remote Code Execution. Unauthenticated attackers can execute arbitrary code on industrial control HMI systems. EPSS 0.64% with PoC available.
Email content leakage in Lettermint Node.js SDK versions 1.5.0 and below allows local authenticated users to intercept sensitive email data when a single client instance sends multiple messages, as email properties are not properly cleared between sends. Applications using transactional email flows with reused client instances risk exposing recipient addresses and message content to unintended parties. The vulnerability has been patched in version 1.5.1.
farmfe/core versions up to 1.7.6 contains a vulnerability that allows attackers to surveil developers running Farm who visit their webpage and steal source code th (CVSS 6.5).
### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. [CVSS 3.7 LOW]
Client-certificate-auth middleware for Node.js versions 0.2.1 and 0.3.0 fails to validate the Host header when redirecting HTTP requests to HTTPS, enabling attackers to craft malicious redirects that direct users to arbitrary domains. Public exploit code exists for this open redirect vulnerability, and no patch is currently available for affected versions.
@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the...
n8n is an open source workflow automation platform. From version 1.65.0 to before 1.114.3, the use of Buffer.allocUnsafe() and Buffer.allocUnsafeSlow() in the task runner allowed untrusted code to allocate uninitialized memory. [CVSS 7.7 HIGH]
Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.3, a denial-of-service vulnerability in Fastify’s Web Streams response handling can allow a remote client to exhaust server memory. Applications that return a ReadableStream (or Response with a Web Stream body) via reply.send() are impacted. A slow or non-reading client can trigger unbounded buffering when backpressure is ignored, leading to process crashes or severe degradation. This issue has been patched in...
jsPDF versions prior to 4.1.0 contain a race condition in the addJS method where a shared module-scoped variable is overwritten during concurrent PDF generation, causing JavaScript payloads and embedded data intended for one user to be included in another user's generated PDF. This cross-user data leakage primarily affects server-side Node.js deployments handling simultaneous requests, allowing attackers to access sensitive information leaked across user sessions. Public exploit code exists for this vulnerability.
Backstage TechDocs plugin versions prior to 1.13.11 and 1.14.1 contain a path traversal vulnerability that allows authenticated attackers to read arbitrary files from the host filesystem when the local generator is enabled. The vulnerability stems from insufficient symlink validation during the documentation build process, enabling attackers to embed sensitive file contents into generated HTML accessible to documentation viewers. Organizations using `techdocs.generator.runIn: local` with untrusted documentation sources are at risk until patching to the fixed versions.
The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability. This occurs because the logfile variable is not properly sanitized in lib/Local.js. [CVSS 7.8 HIGH]
Bun versions prior to 1.3.5 allow attackers to bypass the trusted dependencies allowlist by creating non-npm packages with names matching legitimate packages, enabling potential code execution through dependency confusion attacks. This local vulnerability affects systems using Bun's package management where an attacker can craft malicious packages with identical names to trusted dependencies. No patch is currently available for affected Node.js and GitHub integrations.
pnpm versions before 10.28.2 fail to validate the `directories.bin` field during package processing, allowing malicious packages to use path traversal (e.g., `../../../../tmp`) to escape the package root and chmod 755 files at arbitrary locations on Unix-like systems. Public exploit code exists for this vulnerability. The issue affects Linux, macOS, and Node.js environments but not Windows due to platform-specific protections.
pnpm versions prior to 10.28.2 fail to properly constrain symlink resolution when installing file: and git: dependencies, allowing malicious packages to copy sensitive files from the host system into node_modules and leak credentials. This affects developers using local file dependencies and CI/CD pipelines installing git-based packages, with public exploit code available. The vulnerability enables theft of credentials from locations like ~/.ssh/id_rsa and ~/.npmrc by exploiting symlinks to absolute paths outside the package root.
Pnpm versions up to 10.28.1 contains a vulnerability that allows attackers to overwriting config files, scripts, or other sensitive files (CVSS 6.5).
Path traversal in pnpm's tarball extraction on Windows allows attackers to write files outside the intended package directory by exploiting incomplete path normalization that fails to block backslash-based traversal sequences. Public exploit code exists for this vulnerability, which affects Windows developers and CI/CD pipelines (GitHub Actions, Azure DevOps) and could result in overwriting sensitive configuration files like .npmrc or build configurations. A patch is available in pnpm version 10.28.1 and later.
Path traversal in pnpm's binary fetcher (versions prior to 10.28.1) allows attackers to write files outside the intended extraction directory through malicious ZIP entries or crafted prefix values, potentially overwriting critical configuration files and scripts on affected systems. All pnpm users installing packages with binary assets are vulnerable, particularly those in CI/CD pipelines or with custom Node.js binary configurations. Public exploit code exists for this medium-severity vulnerability.
A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-Resume: 1` header and processes attacker-controlled postponed state data. [CVSS 5.9 MEDIUM]
Openfire 4.6.0 contains a stored cross-site scripting vulnerability in the nodejs plugin that allows attackers to inject malicious scripts through the 'path' parameter. [CVSS 6.4 MEDIUM]
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. [CVSS 7.5 HIGH]
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. [CVSS 7.5 HIGH]
A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. [CVSS 7.5 HIGH]
A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. [CVSS 5.3 MEDIUM]
A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. [CVSS 7.1 HIGH]
Node.js has a permissions model bypass that allows attackers to circumvent --allow-fs-read and --allow-fs-write restrictions using alternate path representations.
Unsafe code generation in binary-parser prior to version 2.3.0 allows remote code execution when processing untrusted input for parser field names or encoding parameters. Node.js applications using vulnerable versions of the library can be compromised to execute arbitrary JavaScript with process-level privileges. A patch is available and exploitation requires no authentication or user interaction.
Symlink poisoning via race condition in node-tar up to version 7.5.3 allows attackers to exploit Unicode normalization on case-insensitive filesystems like macOS APFS, where the path reservation system fails to serialize operations on colliding paths. Public exploit code exists for this vulnerability, enabling concurrent processing that bypasses internal safeguards. Node.js users and applications depending on vulnerable tar versions should update immediately, as attackers can leverage this to manipulate file operations during archive extraction.
Undici versions up to 7.18.0 is affected by allocation of resources without limits or throttling (CVSS 5.9).
Ghost is a Node.js content management system. In versions 5.38.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost’s media inliner mechanism allows staff users in possession of a valid authentication token for the Ghost Admin API to exfiltrate data from internal systems via SSRF. [CVSS 2.7 LOW]
SQL injection in Ghost's Admin API members/events endpoint enables authenticated administrators to execute arbitrary database queries, affecting versions 5.90.0-5.130.5 and 6.0.0-6.10.3. An attacker with valid Admin API credentials could exploit this to extract, modify, or delete sensitive data stored in the Ghost database. Patches are available in versions 5.130.6 and 6.11.0.
A weakness has been identified in carboneio carbone up to fbcd349077ad0e8748be73eab2a82ea92b6f8a7e. This impacts an unknown function of the file lib/input.js of the component Formatter Handler. [CVSS 5.0 MEDIUM]
Local file inclusion and path traversal in the Node.js builds of jsPDF (dist/jspdf.node.js and dist/jspdf.node.min.js) prior to version 4.0.0 lets an attacker who controls the path argument passed to loadFile, addImage, html, or addFont read arbitrary files from the host filesystem, with the file contents embedded verbatim into the generated PDF. Applications that forward unsanitized user input into these methods leak secrets such as /etc/passwd, configuration files, or private keys to anyone who can request a PDF. No public exploit identified at time of analysis; EPSS risk is very low (0.02%, 6th percentile) and the issue is not in CISA KEV.
Signal K Server releases before 2.19.0 let an unauthenticated remote attacker submit a device access request whose attacker-controlled `description` field reads like a benign read-only request while the `permissions` field actually asks for `admin`; the pre-2.19.0 admin UI displays the description prominently and the authoritative permission level less visibly. The same access-request handler trusts the client-supplied `X-Forwarded-For` header without validation, so the source IP shown to the approving administrator can be spoofed to look like a trusted internal address, and chaining this with the accompanying device/source-name information disclosure produces a convincing social-engineering scenario. Publicly available exploit code exists, but the attack is not confirmed actively exploited (CISA KEV is absent) and EPSS is only 0.02% (6th percentile) because a human administrator must manually approve the request (UI:R); Internet-reachable Signal K servers are the highest-risk deployments and the vendor explicitly urges immediate upgrade.
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore interface allow administrators to install npm packages through a REST API endpoint. [CVSS 7.2 HIGH]
Unauthenticated server state pollution in Signal K Server prior to version 2.19.0 lets a network-reachable attacker overwrite the module-global restoreFilePath via the unauthenticated /skServer/validateBackup endpoint, hijacking the administrator's Restore workflow so that attacker-supplied archive contents are written over critical configuration files such as security.json. Overwriting security.json allows creation of a rogue administrator account, which the attacker can then use to reach a separate command-injection flaw in the App Store install path and achieve remote code execution. Publicly available exploit code exists and the vendor explicitly warns Internet-exposed instances to patch immediately, though EPSS remains low at roughly 0.10% (27th percentile); no confirmed active exploitation (CISA KEV) is associated with this issue at time of analysis.
Remote code execution in Titra time-tracking software prior to version 0.99.49 allows an authenticated Admin user to inject arbitrary JavaScript through the global 'timeEntryRule' setting, which is passed unsanitized into a NodeVM sandbox and executed on the server. Because the weakness sits behind the admin login boundary (CVSS vector PR:H), a non-admin or unauthenticated attacker cannot reach the vulnerable setting, but any holder of an Admin account achieves full confidentiality, integrity, and availability impact across the host - worsened in default Docker deployments where the process historically ran as root. Publicly available exploit code exists and the vendor has released a fix in 0.99.49, so this should be treated as a high-priority patch for internet-exposed instances with multiple administrators.
Authentication and authorization bypass in NestJS affects only applications served through the Fastify adapter: @nestjs/platform-fastify versions prior to 11.1.11 fail to execute route-scoped middleware when a request path contains percent-encoded characters, so an unauthenticated remote attacker who requests /%61dmin instead of /admin reaches the protected controller while the middleware that was supposed to guard it is silently skipped. The flaw is conditional - the application must use @nestjs/platform-fastify, must enforce a security check (authentication, authorization, or input validation) inside a NestMiddleware wired through MiddlewareConsumer or app.use(), and must scope that middleware to specific string paths or controllers such as .forRoutes('admin'); globally applied middleware and the default Express platform are not bypassed. Publicly available exploit code exists, and the CVSS 4.0 base score is 6.9 with an independent assessment of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N (unauthenticated, no user interaction, high confidentiality and integrity impact); there is no indication of confirmed active exploitation (not listed in CISA KEV).
OS command injection in the systeminformation Node.js library on Windows allows arbitrary PowerShell command execution when attacker-controlled input reaches the optional `drive` parameter of the fsSize() function. Versions prior to 5.27.14 are affected, but exploitability is conditional: the Node.js process must be running on Windows (win32) and the host application must actually forward user-supplied drive or volume values into fsSize() - applications that call the function with no argument or with hardcoded values, and all non-Windows deployments, are not vulnerable. Publicly available exploit code exists (published alongside advisory GHSA-wphj-fx3q-84ch), though no confirmed active exploitation (CISA KEV) has been reported at time of analysis; the CVSS base score is 8.1 with AC:H precisely because the attack hinges on application data flow rather than a trivially reachable endpoint. Unauthenticated at the library level (PR:N), remote delivery is possible when the vulnerable function is reachable through a web or API surface.
Reflected cross-site scripting in Parse Server's password reset and email verification HTML pages lets unauthenticated remote attackers inject arbitrary script into pages served by the Pages Router by placing a payload in the token, username, or locale query parameter, which the server reflects unescaped back into the response; affected releases are all versions prior to 8.6.1 and the 9.x pre-releases from 9.0.0 up to (but not including) 9.1.0-alpha.3. Because the flaw is reflected rather than stored, exploitation requires a victim to be socially engineered into clicking a crafted link (CVSS UI:R), after which script executes in the victim's browser context with limited confidentiality and integrity impact - no server-side compromise occurs. EPSS is a low 0.22% (11th percentile), this CVE is not in CISA KEV, and no public exploit code has been identified at time of analysis; the assessed risk is moderate rather than high priority.
Challenge payload splicing in the ALTCHA proof-of-work bot-protection libraries lets remote, unauthenticated attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) reuse a previously solved challenge past its intended expiration by reinterpreting a valid HMAC-signed payload with an altered 'expires' parameter. Only deployments that trust the signed payload's embedded expiration without independently tracking consumed challenges are affected; the vendor explicitly conditions impact on 'server-side replay handling and deployment assumptions.' Impact is confined to abuse-prevention controls such as rate limiting and bot mitigation with no effect on data confidentiality or integrity (C:N/I:L/A:L), CISA KEV does not list this issue, no public exploit code has been identified at time of analysis, and the EPSS score of 0.46% (38th percentile) indicates low predicted exploitation activity.
Denial of service in the npm package Servify Express (servify-express) versions 1.1 and earlier allows unauthenticated remote attackers to exhaust server memory and degrade or crash the Node.js process by sending extremely large JSON request bodies to applications that rely on the library's default express.json() configuration without an explicit size limit. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a network-reachable, no-authentication, no-user-interaction availability impact, though exploitation depends on the deployment being internet-facing and not already protected by a body-size limit, rate limiting, or a reverse proxy such as NGINX. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); EPSS is low at 0.07% (21st percentile), and the vendor-released fix is version 1.2.
Confidentiality and integrity of the Parse Server project's own GitHub Actions CI/CD pipeline are at risk because the repository's ci-performance.yml workflow used the 'pull_request_target' trigger while holding write permissions (pull-requests: write, issues: write) and access to repository secrets, allowing code supplied by an external fork - or its lifecycle scripts - to execute inside the privileged base-repository context. Only the project's automation infrastructure, including public forks with GitHub Actions enabled, is exposed; deployed Parse Server instances are unaffected. Exploitation of this CI/CD supply-chain weakness has not been observed in the wild (no public exploit identified at time of analysis), and overall risk is low given a 0.42% EPSS score (34th percentile), though the flaw is rated 6.9 under both CVSS v4.0 and the independently assessed CVSS v3.1 vector. Remote, unauthenticated attackers who can open a pull request from a fork are the threat model; vendor-released fixes exist in 8.6.0-alpha.2 and the commits 6b9f896 and e3d27fe.
Unauthenticated remote attackers can bypass path-based authorization in Form.io 3.5.6 and earlier and 4.0.0-rc.1 through 4.4.2 to read data from protected API endpoints via a crafted request path that exploits improper case handling (CWE-178). This is a confidentiality-only issue affecting deployments that rely on the vulnerable path-matching logic for API protection, with no integrity or availability impact indicated. No public exploit code was identified at time of analysis (EPSS 0.31%, 22nd percentile), and vendor-released fixes are available in Form.io 3.5.7 and 4.4.3.
Concurrent token requests handled by the Auth0 Next.js SDK can be resolved through an internal in-flight request cache to the wrong result, causing an application that uses a singleton Auth0 client to receive an access token belonging to a different, simultaneously executed request - an incorrect-authorization and confidentiality exposure tracked as CWE-863. Only @auth0/nextjs-auth0 versions 4.11.0, 4.11.1, and 4.12.0 are affected; releases 4.11.2 and 4.12.1 remove the faulty TokenRequestCache. Exploitation is gated on winning a non-deterministic concurrency race (AC:H) by an authenticated user of the application (PR:L), the EPSS score is only 0.20% (9th percentile), and no public exploit has been identified at time of analysis.
auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected header or payload in HMAC secret lookup routines, which can allow attackers to bypass signature verification. This issue has been patched in versions 3.2.3 and 4.0.1.
Sentry-Javascript is an official Sentry SDKs for JavaScript. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
esm.sh is a nobuild content delivery network(CDN) for modern web development. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Astro is a web framework. Rated low severity (CVSS 3.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
npm package `expr-eval` is vulnerable to Prototype Pollution. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Socket Firewall is an HTTP/HTTPS proxy server that intercepts package manager requests and enforces security policies by blocking dangerous packages. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
node-tar 7.5.1 can leak uninitialized process memory into the caller's data stream when the synchronous listing API `.t()` / `.list()` is used with `{ sync: true }` and the tar file on disk is truncated to a smaller size mid-read. A local attacker (or any concurrent process with write access to the archive) must win a narrow race window between the initial size lookup and the parser's read of a truncated 512-byte block boundary, after which the parser can hand back bytes of stale heap memory - potentially unrelated file contents, environment variables, or credentials - instead of tar entry data. Real-world risk is limited: the vector is local (CVSS:3.1/AV:L/AC:H/PR:L/UI:R, CVSS 4.0 base 6.1), EPSS is only 0.13% (3rd percentile), the vulnerability is not in CISA KEV, and a publicly available proof-of-concept reproducer exists in the GitHub advisory (GHSA-29xp-372q-xqph) targeting Node.js 22 or >= 25.1.0; the issue is fixed in 7.5.2.
An open redirect in Koa's ctx.back() helper lets remote, unauthenticated attackers force a victim's browser to an attacker-controlled site by sending a crafted Referer header containing a protocol-relative URL such as '//evil.com/login/'. Koa.js versions 2.16.2 up to (but not including) 2.16.3 and 3.0.1 up to (but not including) 3.0.3 are affected; the flaw is a bypass of the earlier fix for CVE-2025-8129/CVE-2025-54420. Publicly available exploit code and a proof-of-concept exist, but EPSS is low (0.29%, 20th percentile) and there is no confirmed active exploitation (not in CISA KEV); exploitation requires user interaction because the victim must trigger the back-redirect flow, and impact is limited to phishing/social-engineering-style redirection rather than server compromise.
Prototype pollution in happy-dom 19.0.0 through 20.0.1 allows attacker-controlled script to break out of the library's intended JavaScript sandbox and run arbitrary operating-system commands inside the host Node.js process. Exploitation requires the embedding application to enable JavaScript evaluation (settings.enableJavaScriptEvaluation: true) and to feed untrusted markup into a Browser/ServerRenderer instance - a non-default configuration, which is why real-world exposure is narrower than the raw score suggests. A working proof-of-concept payload is published in the vendor advisory (GHSA-qpm2-6cq5-7pq5), so publicly available exploit code exists; there is no CISA KEV listing, and EPSS is low (0.35%, ~27th percentile). The flaw is an incomplete fix for CVE-2025-61927 and is remediated in happy-dom 20.0.2.
Improper HTML stripping in the Mailgen Node.js package (versions through 2.0.31) allows attacker-controlled markup to survive Mailgen.generatePlaintext and be emitted in a string the API advertises as plaintext. Remote, unauthenticated attackers who can influence the values passed into generatePlaintext can embed a tag containing a Unicode line separator such as U+2028, which the pre-patch tag-stripping regex fails to match, and if that returned string is later rendered in an HTML context - an email preview or web view - the injected markup executes script in the victim's browser, with the victim having to view/render the content (UI:R). Impact is narrowly conditional (applications that consume the output strictly as plaintext are unaffected, which is why the vendor CVSS 4.0 score is only 2.9), no active exploitation is indicated (not listed in CISA KEV; EPSS 0.45%, 37th percentile), and the upstream advisory documents a proof-of-concept payload; version 2.0.32 fixes the flaw.
HTML injection in Mailgen through 2.0.30 can become XSS when the generatePlaintext() output is rendered as HTML; the flaw lets HTML-entity-encoded tags pass through the tag-stripping regex before he.decode() reactivates them. Exploitation is remote and unauthenticated per the CVSS vector (PR:N) but requires user interaction and the specific misuse of the intended plaintext string as HTML, and only applications passing user-generated content to generatePlaintext are affected. Publicly available exploit code exists, the issue is not confirmed actively exploited (no CISA KEV), EPSS is 0.43% (35th percentile), and the vendor-released fix is Mailgen 2.0.31.
VM context escape in Happy DOM 19.x and earlier allows attacker-controlled JavaScript executed inside a Window to break out of the Node.js VM context and reach process-level functionality; on CommonJS runtimes the escaped code can obtain the require() function, yielding arbitrary module import and full remote code execution, while on ESM the escape yields the process object without require/import. Because JavaScript evaluation is enabled by default in v19 and lower, any application that feeds untrusted HTML or script into a Window (document.write(), innerHTML, or server-side rendering of user-supplied content) is exposed without opting in, and untrusted code does not need to be executed by the victim deliberately. There is no confirmed active exploitation (CISA KEV) and no public exploit weaponization flagged, though the vendor advisory publishes working reproduction snippets; EPSS is low at 0.64% (49th percentile), and the vendor-released patch is Happy DOM 20.0.0, which disables JavaScript evaluation by default.
Authenticated users can upload arbitrary files to Flowise 3.0.7 due to missing validation, enabling persistent storage of Node.js web shells that can lead to remote code execution if triggered. The vulnerability requires low-privilege authentication (PR:L) and has a CVSS score of 8.8; publicly available exploit code exists. While the uploaded shells do not auto-execute, they can be leveraged through administrator error or chained vulnerabilities, posing a high threat to system integrity and confidentiality.