| CVE-2026-106074 |
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`,…
|
4.8
Medium
|
Oct 23, 2026 |
| CVE-2026-105481 |
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before…
|
6.5
Medium
|
Oct 23, 2026 |
| CVE-2026-105482 |
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*()…
|
7.4
High
|
Oct 23, 2026 |
| CVE-2026-105483 |
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a…
|
7.4
High
|
Oct 23, 2026 |
| CVE-2026-106069 |
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP…
|
7.4
High
|
Oct 23, 2026 |
| CVE-2026-106070 |
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after…
|
3.7
Low
|
Oct 23, 2026 |
| CVE-2026-106071 |
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard…
|
3.6
Low
|
Oct 23, 2026 |
| CVE-2026-106072 |
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when…
|
6.7
Medium
|
Oct 23, 2026 |
| CVE-2026-106073 |
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read…
|
3.3
Low
|
Oct 23, 2026 |
| CVE-2026-48932 |
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild…
|
3.7
Low
|
Sep 1, 2026 |
| CVE-2026-56848 |
A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while…
|
7.5
High
|
Aug 4, 2026 |
| CVE-2026-56846 |
A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote…
|
7.5
High
|
Aug 4, 2026 |
| CVE-2026-58041 |
A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to…
|
5.3
Medium
|
Aug 4, 2026 |
| CVE-2026-58042 |
A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A…
|
5.9
Medium
|
Aug 4, 2026 |
| CVE-2026-58044 |
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild…
|
3.7
Low
|
Aug 4, 2026 |
| CVE-2026-58045 |
A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous…
|
6.2
Medium
|
Aug 4, 2026 |
| CVE-2026-58039 |
A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside…
|
3.3
Low
|
Jul 31, 2026 |
| CVE-2026-58043 |
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries
|
7.5
High
|
Jul 30, 2026 |
| CVE-2026-56847 |
A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs…
|
3.3
Low
|
Jul 30, 2026 |
| CVE-2026-56850 |
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS)…
|
4.1
Medium
|
Jul 30, 2026 |
| CVE-2026-58040 |
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across…
|
6.3
Medium
|
Jul 30, 2026 |
| CVE-2026-48930 |
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to…
|
5.6
Medium
|
Jun 26, 2026 |
| CVE-2026-48933 |
A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of…
|
7.5
High
|
Jun 26, 2026 |
| CVE-2026-48934 |
A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation
|
4.3
Medium
|
Jun 26, 2026 |
| CVE-2026-48935 |
A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only…
|
3.3
Low
|
Jun 26, 2026 |