| CVE-2024-21890 |
The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last…
|
5.0
Medium
|
Feb 20, 2024 |
| CVE-2024-22019 |
A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked…
|
7.5
High
|
Feb 20, 2024 |
| CVE-2024-21896 |
The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by…
|
7.9
High
|
Feb 20, 2024 |
| CVE-2023-30588 |
When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect…
|
Not rated
|
Nov 28, 2023 |
| CVE-2023-30590 |
The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys,…
|
Not rated
|
Nov 28, 2023 |
| CVE-2023-30585 |
A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows…
|
Not rated
|
Nov 28, 2023 |
| CVE-2023-30581 |
The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules…
|
7.5
High
|
Nov 22, 2023 |
| CVE-2023-39331 |
A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6
|
7.7
High
|
Oct 18, 2023 |
| CVE-2023-39332 |
Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects
|
Not rated
|
Oct 18, 2023 |
| CVE-2023-38552 |
When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can…
|
Not rated
|
Oct 18, 2023 |
| CVE-2023-32558 |
The use of the deprecated API `process.binding()` can bypass the permission model through path traversal
|
Not rated
|
Sep 12, 2023 |
| CVE-2023-32005 |
A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the…
|
5.3
Medium
|
Sep 12, 2023 |
| CVE-2023-32559 |
A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x…
|
7.5
High
|
Aug 24, 2023 |
| CVE-2023-32002 |
The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition…
|
9.8
Critical
|
Aug 21, 2023 |
| CVE-2023-32003 |
`fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack
|
5.3
Medium
|
Aug 15, 2023 |
| CVE-2023-32004 |
A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model
|
8.8
High
|
Aug 15, 2023 |
| CVE-2023-32006 |
The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the…
|
8.8
High
|
Aug 15, 2023 |
| CVE-2023-30586 |
A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the…
|
7.5
High
|
Jun 30, 2023 |
| CVE-2023-30589 |
The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests
|
Not rated
|
Jun 30, 2023 |
| CVE-2023-23920 |
An untrusted search path vulnerability exists in Node.js
|
4.2
Medium
|
Feb 23, 2023 |
| CVE-2023-23919 |
A cryptographic vulnerability exists in…
|
7.5
High
|
Feb 23, 2023 |
| CVE-2023-23918 |
A privilege escalation vulnerability exists in…
|
7.5
High
|
Feb 23, 2023 |
| CVE-2022-43548 |
A OS Command Injection vulnerability exists in Node.js…
|
8.1
High
|
Dec 5, 2022 |
| CVE-2022-35256 |
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated…
|
6.5
Medium
|
Dec 5, 2022 |
| CVE-2022-35255 |
A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in…
|
9.1
Critical
|
Dec 5, 2022 |