| CVE-2024-21890 |
The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last…
|
5.0
Moyenne
|
20 févr. 2024 |
| CVE-2024-22019 |
A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked…
|
7.5
Élevée
|
20 févr. 2024 |
| CVE-2024-21896 |
The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by…
|
7.9
Élevée
|
20 févr. 2024 |
| CVE-2023-30588 |
When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect…
|
Non notée
|
28 nov. 2023 |
| CVE-2023-30590 |
The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys,…
|
Non notée
|
28 nov. 2023 |
| CVE-2023-30585 |
A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows…
|
Non notée
|
28 nov. 2023 |
| CVE-2023-30581 |
The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules…
|
7.5
Élevée
|
22 nov. 2023 |
| CVE-2023-39331 |
A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6
|
7.7
Élevée
|
18 oct. 2023 |
| CVE-2023-39332 |
Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects
|
Non notée
|
18 oct. 2023 |
| CVE-2023-38552 |
When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can…
|
Non notée
|
18 oct. 2023 |
| CVE-2023-32558 |
The use of the deprecated API `process.binding()` can bypass the permission model through path traversal
|
Non notée
|
12 sept. 2023 |
| CVE-2023-32005 |
A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the…
|
5.3
Moyenne
|
12 sept. 2023 |
| CVE-2023-32559 |
A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x…
|
7.5
Élevée
|
24 août 2023 |
| CVE-2023-32002 |
The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition…
|
9.8
Critique
|
21 août 2023 |
| CVE-2023-32003 |
`fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack
|
5.3
Moyenne
|
15 août 2023 |
| CVE-2023-32004 |
A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model
|
8.8
Élevée
|
15 août 2023 |
| CVE-2023-32006 |
The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the…
|
8.8
Élevée
|
15 août 2023 |
| CVE-2023-30586 |
A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the…
|
7.5
Élevée
|
30 juin 2023 |
| CVE-2023-30589 |
The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests
|
Non notée
|
30 juin 2023 |
| CVE-2023-23920 |
An untrusted search path vulnerability exists in Node.js
|
4.2
Moyenne
|
23 févr. 2023 |
| CVE-2023-23919 |
A cryptographic vulnerability exists in…
|
7.5
Élevée
|
23 févr. 2023 |
| CVE-2023-23918 |
A privilege escalation vulnerability exists in…
|
7.5
Élevée
|
23 févr. 2023 |
| CVE-2022-43548 |
A OS Command Injection vulnerability exists in Node.js…
|
8.1
Élevée
|
5 déc. 2022 |
| CVE-2022-35256 |
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated…
|
6.5
Moyenne
|
5 déc. 2022 |
| CVE-2022-35255 |
A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in…
|
9.1
Critique
|
5 déc. 2022 |