| CVE-2025-27209 |
The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash
|
7.5
High
|
Jul 18, 2025 |
| CVE-2025-23167 |
A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required…
|
6.5
Medium
|
May 19, 2025 |
| CVE-2025-23166 |
The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when…
|
7.5
High
|
May 19, 2025 |
| CVE-2025-23165 |
In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path…
|
3.7
Low
|
May 19, 2025 |
| CVE-2025-23085 |
A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification
|
5.3
Medium
|
Feb 7, 2025 |
| CVE-2025-23084 |
A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows…
|
5.6
Medium
|
Jan 28, 2025 |
| CVE-2025-23083 |
With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created
|
7.7
High
|
Jan 22, 2025 |
| CVE-2024-37372 |
The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be…
|
3.6
Low
|
Jan 9, 2025 |
| CVE-2024-27980 |
Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line…
|
8.1
High
|
Jan 9, 2025 |
| CVE-2023-46809 |
Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL…
|
7.4
High
|
Sep 7, 2024 |
| CVE-2024-36138 |
Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible…
|
8.1
High
|
Sep 7, 2024 |
| CVE-2023-39333 |
Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code
|
5.3
Medium
|
Sep 7, 2024 |
| CVE-2024-36137 |
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the…
|
3.3
Low
|
Sep 7, 2024 |
| CVE-2023-30587 |
A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag…
|
7.5
High
|
Sep 7, 2024 |
| CVE-2023-30584 |
A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model
|
7.7
High
|
Sep 7, 2024 |
| CVE-2023-30583 |
fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the…
|
7.5
High
|
Sep 7, 2024 |
| CVE-2023-30582 |
A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the…
|
5.3
Medium
|
Sep 7, 2024 |
| CVE-2024-22018 |
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the…
|
2.9
Low
|
Jul 10, 2024 |
| CVE-2024-22020 |
A security flaw in Node.js allows a bypass of network import restrictions
|
6.5
Medium
|
Jul 9, 2024 |
| CVE-2024-27982 |
The team has identified a critical vulnerability in the http server of the most recent version of Node, where…
|
6.5
Medium
|
May 7, 2024 |
| CVE-2024-27983 |
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets…
|
8.2
High
|
Apr 9, 2024 |
| CVE-2024-22025 |
A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource…
|
6.5
Medium
|
Mar 19, 2024 |
| CVE-2024-22017 |
setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid()
|
7.3
High
|
Mar 19, 2024 |
| CVE-2024-21892 |
On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the…
|
7.5
High
|
Feb 20, 2024 |
| CVE-2024-21891 |
Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be…
|
7.9
High
|
Feb 20, 2024 |