All · Node.js
Newest first. Every filter here is also a feed: see the subscribe box.
- 7.4highCVE-2026-106069A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the…14 d ago
- 6.5medCVE-2026-105481A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the…14 d ago
- 7.4highCVE-2026-105482A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.re…14 d ago
- 4.8medCVE-2026-106074A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt…14 d ago
- 3.6lowCVE-2026-106071A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--al…14 d ago
- 6.7medCVE-2026-106072A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connect…14 d ago
- 7.4highCVE-2026-105483A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4…14 d ago
- 3.7lowCVE-2026-106070A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central…14 d ago
- 3.3lowCVE-2026-106073A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks.14 d ago
- 9.8crit15 d ago
- 3.7lowCVE-2026-48932A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from…2 mo ago
- 7.5highCVE-2026-56848A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is execu…3 mo ago
- 5.9medCVE-2026-58042A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records.3 mo ago
- 7.5highCVE-2026-56846A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion.3 mo ago
- 3.7lowCVE-2026-58044A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from…3 mo ago
- 6.2medCVE-2026-58045A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing…3 mo ago
- 5.3medCVE-2026-58041A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a ca…3 mo ago
- 3.3lowCVE-2026-58039A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths.3 mo ago
- 3.3lowCVE-2026-56847A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`.…3 mo ago
- 7.5highCVE-2026-58043A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.3 mo ago
- 4.1medCVE-2026-56850A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to b…3 mo ago
- 6.3medCVE-2026-58040An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incom…3 mo ago
- 5.6medCVE-2026-48930A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation…4 mo ago
- 4.2medCVE-2026-48928A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups.4 mo ago
- 4.3medCVE-2026-48934A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.4 mo ago
- 3.3lowCVE-2026-48936A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permissi…4 mo ago
- 7.7highCVE-2026-48618A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypa…4 mo ago
- 7.5highCVE-2026-48933A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB.4 mo ago
- 3.3lowCVE-2026-48935A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g.4 mo ago
- 5.3medCVE-2026-48619A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on…4 mo ago