| CVE-2026-48615 |
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages
|
5.9
Medium
|
Jun 26, 2026 |
| CVE-2026-48936 |
A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the…
|
3.3
Low
|
Jun 26, 2026 |
| CVE-2026-48618 |
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls…
|
7.7
High
|
Jun 26, 2026 |
| CVE-2026-48619 |
A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out…
|
5.3
Medium
|
Jun 26, 2026 |
| CVE-2026-48928 |
A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups
|
4.2
Medium
|
Jun 26, 2026 |
| CVE-2026-48931 |
A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent…
|
3.7
Low
|
Jun 22, 2026 |
| CVE-2026-48937 |
A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame
|
5.3
Medium
|
Jun 18, 2026 |
| CVE-2026-48617 |
A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation
|
1.8
Low
|
Jun 18, 2026 |
| CVE-2026-21714 |
A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level)…
|
5.3
Medium
|
Mar 30, 2026 |
| CVE-2026-21715 |
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read…
|
3.3
Low
|
Mar 30, 2026 |
| CVE-2026-21716 |
An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without…
|
3.3
Low
|
Mar 30, 2026 |
| CVE-2026-21717 |
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash…
|
5.9
Medium
|
Mar 30, 2026 |
| CVE-2026-21710 |
A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named…
|
7.5
High
|
Mar 30, 2026 |
| CVE-2026-21711 |
A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the…
|
5.3
Medium
|
Mar 30, 2026 |
| CVE-2026-21713 |
A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures,…
|
5.9
Medium
|
Mar 30, 2026 |
| CVE-2026-21712 |
A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a…
|
5.7
Medium
|
Mar 30, 2026 |
| CVE-2025-55132 |
A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()`…
|
2.8
Low
|
Jan 20, 2026 |
| CVE-2025-59464 |
A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without…
|
6.5
Medium
|
Jan 20, 2026 |
| CVE-2025-59465 |
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an…
|
7.5
High
|
Jan 20, 2026 |
| CVE-2025-59466 |
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable…
|
5.9
Medium
|
Jan 20, 2026 |
| CVE-2026-21636 |
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when…
|
5.8
Medium
|
Jan 20, 2026 |
| CVE-2026-21637 |
A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when…
|
5.9
Medium
|
Jan 20, 2026 |
| CVE-2025-55130 |
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions…
|
7.1
High
|
Jan 20, 2026 |
| CVE-2025-55131 |
A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using…
|
7.1
High
|
Jan 20, 2026 |
| CVE-2025-27210 |
An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like…
|
7.5
High
|
Jul 18, 2025 |