| CVE-2025-27210 |
An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like…
|
7.5
High
|
Jul 18, 2025 |
| CVE-2023-46809 |
Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL…
|
7.4
High
|
Sep 7, 2024 |
| CVE-2024-36138 |
Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible…
|
8.1
High
|
Sep 7, 2024 |
| CVE-2023-39333 |
Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code
|
5.3
Medium
|
Sep 7, 2024 |
| CVE-2023-30587 |
A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag…
|
7.5
High
|
Sep 7, 2024 |
| CVE-2023-30584 |
A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model
|
7.7
High
|
Sep 7, 2024 |
| CVE-2023-30583 |
fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the…
|
7.5
High
|
Sep 7, 2024 |
| CVE-2023-30582 |
A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the…
|
5.3
Medium
|
Sep 7, 2024 |
| CVE-2024-22020 |
A security flaw in Node.js allows a bypass of network import restrictions
|
6.5
Medium
|
Jul 9, 2024 |
| CVE-2024-3566 |
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly…
|
9.8
Critical
|
Apr 10, 2024 |
| CVE-2024-27983 |
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets…
|
8.2
High
|
Apr 9, 2024 |
| CVE-2024-22017 |
setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid()
|
7.3
High
|
Mar 19, 2024 |
| CVE-2024-21891 |
Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be…
|
7.9
High
|
Feb 20, 2024 |
| CVE-2024-21896 |
The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by…
|
7.9
High
|
Feb 20, 2024 |
| CVE-2023-32559 |
A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x…
|
7.5
High
|
Aug 24, 2023 |
| CVE-2023-32002 |
The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition…
|
9.8
Critical
|
Aug 21, 2023 |