Lỗ hổng bảo mật Node.js

204 lỗ hổng đã công bố của Node.js, mới nhất trước. Cập nhật 31/10/2026.

Các nhánh

Nhánh	Bản mới nhất	Ra mắt	Hết hỗ trợ
26	26.13.0	05/05/2026	30/04/2029	Còn hỗ trợ
25	25.9.0	15/10/2025	01/06/2026	Đã hết
24	24.22.2	06/05/2025	30/04/2028	Còn hỗ trợ
23	23.11.1	16/10/2024	01/06/2025	Đã hết
22	22.23.4	24/04/2024	30/04/2027	Còn hỗ trợ
21	21.7.3	17/10/2023	01/06/2024	Đã hết
20	20.20.2	18/04/2023	30/04/2026	Đã hết
19	19.9.0	18/10/2022	01/06/2023	Đã hết
18	18.20.8	19/04/2022	30/04/2025	Đã hết
17	17.9.1	19/10/2021	01/06/2022	Đã hết
16	16.20.2	20/04/2021	11/09/2023	Đã hết
15	15.14.0	20/10/2020	01/06/2021	Đã hết

Tóm tắt giữ nguyên tiếng Anh như trong cảnh báo gốc.

Ngày công bố	Mức độ	ID	Tóm tắt	Bản bị ảnh hưởng
10/2026	Trung bình	CVE-2026-105481	Keep-alive socket process a response that was written before the request was sent	`22.x · 24.x · 26.x`
10/2026	Cao	CVE-2026-105482	dns.resolve truncates names containing NUL char	`22.x · 24.x · 26.x`
10/2026	Cao	CVE-2026-105483	TLS certificate hostname bypass when the IP is written fullwidth digits	`24.x · 26.x`
10/2026	Cao	CVE-2026-106069	TLS certificate hostname bypass when the host loosely resolves to an IP address	`22.x · 24.x · 26.x`
10/2026	Thấp	CVE-2026-106070	Node.js ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation	`26.x`
10/2026	Thấp	CVE-2026-106071	Permission Model filesystem over-grant via wildcard radix lookup	`26.x`
10/2026	Trung bình	CVE-2026-106072	Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints	`22.x · 24.x · 26.x`
10/2026	Thấp	CVE-2026-106073	Permission Model bypass with fs.realpathSync	`22.x · 24.x · 26.x`
10/2026	Trung bình	CVE-2026-106074	crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values	`22.x · 24.x · 26.x`
10/2026	Cao	CVE-2026-111497	Node.js Brotli decoder out-of-bounds write permits remote code execution	`22.x · 24.x · 26.x`
07/2026	Cao	CVE-2026-56846	HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion	`22.x · 24.x`
07/2026	Thấp	CVE-2026-56847	Permission Model Bypass: `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`	`22.x · 24.x · 26.x`
07/2026	Cao	CVE-2026-56848	Re-entrant `nghttp2_session_mem_send()` during `nghttp2_session_mem_recv()` causes heap-use-after-free in Node.js HTTP/2	`22.x · 24.x · 26.x`
07/2026	Trung bình	CVE-2026-56850	HTTPS Agent PFX object-array key collision allows mTLS client identity reuse across different per-request certificates	`22.x · 24.x · 26.x`
07/2026	Thấp	CVE-2026-58039	Permission Model bypass: process.report writes (and overwrites) files outside --allow-fs-write paths	`22.x · 24.x · 26.x`
07/2026	Trung bình	CVE-2026-58040	HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934)	`22.x · 24.x · 26.x`
07/2026	Trung bình	CVE-2026-58041	node:sqlite SQLTagStore Iterator Replay Lets Attacker Re-Execute Victim-Bound Writes Indefinitely	`24.x · 26.x`
07/2026	Trung bình	CVE-2026-58042	dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records	`22.x · 24.x · 26.x`
07/2026	Cao	CVE-2026-58043	Permission Model: --allow-fs-read/--allow-fs-write radix-tree prefix-boundary over-grant	`22.x · 24.x · 26.x`
07/2026	Thấp	CVE-2026-58044	HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP Parser	`22.x · 24.x · 26.x`
07/2026	Trung bình	CVE-2026-58045	Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected)	`22.x · 24.x · 26.x`
06/2026	Trung bình	CVE-2026-48615	Proxy credentials leaked in ERR_PROXY_TUNNEL error message	`22.x · 24.x · 26.x`
06/2026	Thấp	CVE-2026-48617	Permission Model Bypass via `process.report.writeReport()` Path Misvalidation	`22.x · 24.x · 26.x`
06/2026	Cao	CVE-2026-48618	Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat	`22.x · 24.x · 26.x`
06/2026	Trung bình	CVE-2026-48619	Unbounded memory growth in `node:http2` clients via attacker-controlled ORIGIN frames	`22.x · 24.x · 26.x`
06/2026	Trung bình	CVE-2026-48928	Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching	`22.x · 24.x · 26.x`
06/2026	Trung bình	CVE-2026-48930	Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings	`22.x · 24.x · 26.x`
06/2026	Thấp	CVE-2026-48931	HTTP Response Queue Poisoning via TOCTOU Race Condition in `http.Agent`	`22.x · 24.x · 26.x`
06/2026	Cao	CVE-2026-48933	Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (DoS)	`22.x · 24.x · 26.x`
06/2026	Trung bình	CVE-2026-48934	TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections	`22.x · 24.x · 26.x`
06/2026	Thấp	CVE-2026-48935	Permission Model bypass via FileHandle.utimes() in the promises API	`22.x · 24.x · 26.x`
06/2026	Thấp	CVE-2026-48936	Unix domain socket server bypasses --permission network restrictions (incomplete CVE-2026-21636 fix)	`26.x`
06/2026	Trung bình	CVE-2026-48937	HTTP/2 sessions never clean up after GOAWAY on invalid protocol errors	`22.x · 24.x`
03/2026	Cao	CVE-2026-21637	Incomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoS	`20.x · 22.x · 24.x · 25.x`
03/2026	Cao	CVE-2026-21710	Denial of Service via `__proto__` header name in `req.headersDistinct` (Uncaught `TypeError` crashes Node.js process)	`20.x · 22.x · 24.x · 25.x`
03/2026	Trung bình	CVE-2026-21711	Node.js Permission Model bypass: UDS server bind/listen works without `--allow-net`	`25.x`
03/2026	Trung bình	CVE-2026-21712	Assertion error in node_url.cc via malformed URL format leads to Node.js crash	`24.x · 25.x`
03/2026	Trung bình	CVE-2026-21713	Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery	`20.x · 22.x · 24.x · 25.x`
03/2026	Trung bình	CVE-2026-21714	Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion	`20.x · 22.x · 24.x · 25.x`
03/2026	Thấp	CVE-2026-21715	Permission Model Bypass in realpathSync.native Allows File Existence Disclosure	`20.x · 22.x · 24.x · 25.x`
03/2026	Thấp	CVE-2026-21716	CVE-2024-36137 Patch Bypass - FileHandle.chmod/chown	`20.x · 22.x · 24.x · 25.x`
03/2026	Trung bình	CVE-2026-21717	HashDoS in V8	`20.x · 22.x · 24.x · 25.x`
12/2025	Cao	CVE-2025-55130	FS Permissions Bypass	`20.x · 22.x · 24.x · 25.x`
12/2025	Cao	CVE-2025-55131	Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled	`20.x · 22.x · 24.x · 25.x`
12/2025	Thấp	CVE-2025-55132	fs.futimes() Bypasses Read-Only Permission Model	`20.x · 22.x · 24.x · 25.x`
12/2025	Trung bình	CVE-2025-59464	Memory leak that enables remote Denial of Service against applications processing TLS client certificates	`20.x · 22.x · 24.x`
12/2025	Cao	CVE-2025-59465	Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame	`20.x · 22.x · 24.x · 25.x`
12/2025	Trung bình	CVE-2025-59466	Uncatchable "Maximum call stack size exceeded" error on Node.js via async_hooks leads to process crashes bypassing error handlers	`20.x · 22.x · 24.x · 25.x`
12/2025	Trung bình	CVE-2026-21636	Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS)	`25.x`
07/2025	Cao	CVE-2025-27209	HashDoS in V8	`24.x`
07/2025	Cao	CVE-2025-27210	Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()	`20.x · 22.x · 24.x`
05/2025	Thấp	CVE-2025-23165	Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string.	`20.x · 22.x`
05/2025	Cao	CVE-2025-23166	Improper error handling in async cryptographic operations crashes process	`20.x · 22.x · 23.x · 24.x`
05/2025	Trung bình	CVE-2025-23167	Improper HTTP header block termination in llhttp	`20.x`
01/2025	Cao	CVE-2025-23083	Worker permission bypass via InternalWorker leak in diagnostics	`20.x · 22.x · 23.x`
01/2025	Trung bình	CVE-2025-23084	Path traversal by drive name in Windows environment	`18.x · 20.x · 22.x · 23.x`
01/2025	Trung bình	CVE-2025-23085	GOAWAY HTTP/2 frames cause memory leak outside heap	`18.x · 20.x · 22.x · 23.x`
07/2024	Thấp	CVE-2024-22018	fs.lstat bypasses permission model	`20.x · 22.x`
07/2024	Trung bình	CVE-2024-22020	Bypass network import restriction via data URL	`18.x · 20.x · 22.x`
07/2024	Thấp	CVE-2024-36137	fs.fchown/fchmod bypasses permission model	`20.x · 22.x`
07/2024	Cao	CVE-2024-36138	Bypass incomplete fix of CVE-2024-27980	`18.x · 20.x · 22.x`
07/2024	Thấp	CVE-2024-37372	Permission model improperly processes UNC paths	`20.x · 22.x`
04/2024	Cao	CVE-2024-27980	Command injection via args parameter of child_process.spawn without shell option enabled on Windows	`18.x · 20.x · 21.x`
04/2024	Cao	CVE-2024-27980	Command injection via args parameter of child_process.spawn without shell option enabled on Windows	`18.x · 20.x · 21.x`
04/2024	Trung bình	CVE-2024-27982	HTTP Request Smuggling via Content Length Obfuscation	`18.x · 20.x · 21.x`
04/2024	Cao	CVE-2024-27983	Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash	`18.x · 20.x · 21.x`
02/2024	Trung bình	CVE-2023-46809	A vulnerability in the privateDecrypt() API of the crypto library, allowed a covert timing side-channel during PKCS#1 v1.5 padding error handling.	`18.x · 20.x · 21.x`
02/2024	Trung bình	CVE-2024-21890	Improper handling of wildcards in --allow-fs-read and --allow-fs-write	`20.x · 21.x`
02/2024	Trung bình	CVE-2024-21891	Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission model bypass through path traversal attack.	`20.x · 21.x`
02/2024	Cao	CVE-2024-21892	Code injection and privilege escalation through Linux capabilities	`18.x · 20.x · 21.x`
02/2024	Cao	CVE-2024-21896	The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve().	`20.x · 21.x`
02/2024	Cao	CVE-2024-22017	setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid()	`20.x · 21.x`
02/2024	Cao	CVE-2024-22019	A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS).	`18.x · 20.x · 21.x`
02/2024	Trung bình	CVE-2024-22025	A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetch() function to retrieve content from an untrusted URL.	`18.x · 20.x · 21.x`
10/2023	Trung bình	CVE-2023-38552	Integrity checks according to experimental policies can be circumvented (Medium)	`18.x · 20.x`
10/2023	Cao	CVE-2023-39331	A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently. The implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations (High)	`20.x`
10/2023	Cao	CVE-2023-39332	Path traversal through path stored in Uint8Array (High)	`20.x`
10/2023	Thấp	CVE-2023-39333	Code injection via WebAssembly export names (Low)	`18.x · 20.x`
10/2023	Cao	CVE-2023-44487	Rapidly creating and cancelling streams (HEADERS frame immediately followed by RST_STREAM) without bound causes denial of service (High)	`18.x · 20.x`
10/2023	Thấp	CVE-2023-45143	Cookie headers are not cleared in cross-domain redirect in undici-fetch (High)	`18.x · 20.x`
08/2023	Cao	CVE-2023-32002	The use of Module._load() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.	`16.x · 18.x · 20.x`
08/2023	Trung bình	CVE-2023-32003	fs.mkdtemp() and fs.mkdtempSync() can be used to bypass the permission model check using a path traversal attack.	`20.x`
08/2023	Cao	CVE-2023-32004	Improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions.	`20.x`
08/2023	Trung bình	CVE-2023-32005	A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument.	`20.x`
08/2023	Cao	CVE-2023-32006	The use of module.constructor.createRequire() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.	`16.x · 18.x · 20.x`
08/2023	Cao	CVE-2023-32558	The use of the deprecated API process.binding() can bypass the permission model through path traversal.	`20.x`
08/2023	Cao	CVE-2023-32559	The use of the deprecated API process.binding() can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding('spawn_sync') run arbitrary code, outside of the limits defined in a policy.json file.	`16.x · 18.x · 20.x`
06/2023	Cao	CVE-2023-30581	The use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules outside of the policy.json definition	`16.x · 18.x · 20.x`
06/2023	Trung bình	CVE-2023-30582	A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument.	`20.x`
06/2023	Trung bình	CVE-2023-30583	fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the --allow-fs-read flag in Node.js 20	`20.x`
06/2023	Cao	CVE-2023-30584	A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions.	`20.x`
06/2023	Trung bình	CVE-2023-30585	Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process	`16.x · 18.x · 20.x`
06/2023	Trung bình	CVE-2023-30586	Node.js 20 allows loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model.	`20.x`
06/2023	Cao	CVE-2023-30587	A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module (node:inspector).	`20.x`
06/2023	Trung bình	CVE-2023-30588	When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs.	`16.x · 18.x · 20.x`
06/2023	Trung bình	CVE-2023-30589	The llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests.	`16.x · 18.x · 20.x`
06/2023	Trung bình	CVE-2023-30590	The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet.	`16.x · 18.x · 20.x`
02/2023	Cao	CVE-2023-23918	It was possible to bypass Permissions and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.	`14.x · 16.x · 18.x · 19.x`
02/2023	Trung bình	CVE-2023-23919	In some cases Node.js did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.	`14.x · 16.x · 18.x · 19.x`
02/2023	Thấp	CVE-2023-23920	Node.js would search and potentially load ICU data when running with elevated priviledges. Node.js was modified to build with ICU_NO_USER_DATA_OVERRIDE to avoid this.	`14.x · 16.x · 18.x · 19.x`
02/2023	Trung bình	CVE-2023-23936	The fetch API in Node.js did not prevent CRLF injection in the 'host' header potentially allowing attacks such as HTTP response splitting and HTTP header injection.	`14.x · 16.x · 18.x · 19.x`
02/2023	Thấp	CVE-2023-24807	The Headers.set() and Headers.append() methods in the fetch API in Node.js where vulnerable to Regular a Expression Denial of Service (ReDoS) attacks.	`14.x · 16.x · 18.x · 19.x`
11/2022	Trung bình	CVE-2022-43548	The Node.js rebinding protector for --inspect still allows invalid IP address, specifically, the octal format.	`14.x · 16.x · 18.x · 19.x`
09/2022	Cao	CVE-2022-32212	The IsAllowedHost check in https://github.com/nodejs/node/blob/fdf0a84e826d3a9ec0ce6f5a3f5adc967fe99408/src/inspector_socket.cc#L580 can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid or not. When an invalid IPv4 address is provided (for instance 10.0.2.555 is provided), the browser will make a DNS requests to the DNS server, providing a vector for an at	`14.x · 16.x · 18.x`
09/2022	Trung bình	CVE-2022-32213	The llhttp parser in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).	`14.x · 16.x · 18.x`
09/2022	Trung bình	CVE-2022-32215	The llhttp parser in the http module in Node does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).	`14.x · 16.x · 18.x`
09/2022	Trung bình	CVE-2022-32222	On linux, versions of 18.x prior to Y used a default path for openssl.cnf that was within a path that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3.	`14.x · 16.x · 18.x`
09/2022	Cao	CVE-2022-35255	Node.js made calls to EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. However, it does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail.	`18.x`
09/2022	Trung bình	CVE-2022-35256	The llhttp parser in the http module in Node.js v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.	`14.x · 16.x · 18.x`
07/2022	Trung bình	CVE-2022-32214	The llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).	`14.x · 16.x · 18.x`
07/2022	Cao	CVE-2022-32223	Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms. This vulnerability can be exploited if the victim has the following dependencies on a Windows machine: * OpenSSL has been installed and “C:\Program Files\Common Files\SSL\openssl.cnf” exists. Whenever the above conditions are present, `node.exe` will search for `providers.dll` in the curren	`14.x · 16.x · 18.x`
07/2021	Trung bình	CVE-2021-22918	Node.js is vulnerable to out-of-bounds read in libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22918	`12.x · 14.x · 16.x`
07/2021	Trung bình	CVE-2021-22921	Node.js is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22921	`12.x · 14.x · 16.x`
07/2021	Cao	CVE-2021-22930	Node.js before is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22930	`12.x · 14.x · 16.x`
07/2021	Trung bình	CVE-2021-23362	This is a vulnerability in the hosted-git-info npm module which may be vulnerable to denial of service attacks. You can read more about it in https://nvd.nist.gov/vuln/detail/CVE-2021-23362	`12.x`
07/2021	Cao	CVE-2021-27290	This is a vulnerability in the ssri npm module which may be vulnerable to denial of service attacks. You can read more about it in https://github.com/advisories/GHSA-vx3p-948g-6vhq	`12.x`
04/2021	Cao	CVE-2020-7774	This is a vulnerability in the y18n npm module which may be exploited by prototype pollution. You can read more about it in https://github.com/advisories/GHSA-c4w7-xm78-47vh	`10.x · 12.x · 14.x`
04/2021	Cao	CVE-2021-3449	This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210325.txt	`10.x · 12.x · 14.x · 15.x`
04/2021	Cao	CVE-2021-3450	This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210325.txt	`10.x · 12.x · 14.x · 15.x`
02/2021	Nghiêm trọng	CVE-2021-22883	HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion - Affected Node.js versions are vulnerable to denial of service attacks when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also f	`10.x · 12.x · 14.x · 15.x`
02/2021	Cao	CVE-2021-22884	DNS rebinding in --inspect - Affected Node.js versions are vulnerable to denial of service attacks when the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the	`10.x · 12.x · 14.x · 15.x`
02/2021	Cao	CVE-2021-23840	OpenSSL - Integer overflow in CipherUpdate - This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210216.txt	`10.x · 12.x · 14.x · 15.x`
01/2021	Trung bình	CVE-2020-1971	OpenSSL - EDIPARTYNAME NULL pointer de-reference - This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20201208.txt	`10.x · 12.x · 14.x · 15.x`
01/2021	Cao	CVE-2020-8265	use-after-free in TLSWrap - affected Node.js versions are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structur	`10.x · 12.x · 14.x · 15.x`
01/2021	Thấp	CVE-2020-8287	HTTP Request Smuggling in nodejs - Affected versions of Node.js allow two copies of a header field in a http request. For example, two Transfer-Encoding header fields. In this case Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling (https://cwe.mitre.org/data/definitions/444.html)	`10.x · 12.x · 14.x · 15.x`

79 lỗ hổng công bố trước 2021

Ngày công bố	Mức độ	ID	Bản bị ảnh hưởng
11/2020	Cao	CVE-2020-8277	`12.x · 14.x · 15.x`
09/2020	Cao	CVE-2020-8201	`12.x · 14.x`
09/2020	Nghiêm trọng	CVE-2020-8251	`14.x`
09/2020	Trung bình	CVE-2020-8252	`10.x · 12.x · 14.x`
15/08/2019	Cao	CVE-2019-9511	`8.x · 10.x · 12.x`
28/02/2019	Cao	CVE-2019-5737	`6.x · 8.x · 10.x · 11.x`
28/02/2019	Cao	CVE-2019-5739	`6.x`
27/11/2018	Cao	CVE-2018-12116	`6.x · 8.x`
27/11/2018	Cao	CVE-2018-12120	`6.x · 8.x`
27/11/2018	Cao	CVE-2018-12121	`6.x · 8.x · 10.x · 11.x`
27/11/2018	Cao	CVE-2018-12122	`6.x · 8.x · 10.x · 11.x`
27/11/2018	Trung bình	CVE-2018-12123	`6.x · 8.x · 10.x · 11.x`
16/08/2018	Cao	CVE-2018-12115	`<= 10`
16/08/2018	Cao	CVE-2018-7166	`10.x`
06/2018	Cao	CVE-2018-7161	`8.x · 9.x · 10.x`
06/2018	Cao	CVE-2018-7162	`9.x · 10.x`
06/2018	Cao	CVE-2018-7164	`9.7.x · 10.x`
06/2018	Cao	CVE-2018-7167	`6.x · 8.x · 9.x`
03/2018	Cao	CVE-2018-7158	`4.x`
03/2018	Trung bình	CVE-2018-7159	`4.x · 6.x · 8.x · 9.x`
03/2018	Cao	CVE-2018-7160	`6.x · 8.x · 9.x`
12/2017	Nghiêm trọng	CVE-2017-15896	`4.x · 6.x · 8.x · 9.x`
12/2017	Thấp	CVE-2017-15897	`8.x · 9.x`
09/2017	Cao	CVE-2017-14849	`8.5.0`
07/2017	Cao	CVE-2017-1000381	`8.x · 7.x · 4.x · 6.x · 5.x`
01/2017	Trung bình	CVE-2016-7055	`4.x · 5.x · 6.x · 7.x`
01/2017	Cao	CVE-2017-3731	`4.x · 5.x · 6.x · 7.x`
01/2017	Trung bình	CVE-2017-3732	`4.x · 5.x · 6.x · 7.x`
10/2016	Trung bình	CVE-2016-5172	`6.x`
10/2016	Trung bình	nodejs-security-wg-11	`6.x`
10/2016	Trung bình	nodejs-security-wg-9	`6.x`
06/2016	Cao	CVE-2016-1669	`>=6.0.0 <6.2.0 · 5.x · 4.x`
05/2016	Cao	CVE-2016-2105	`4.x · 5.x · 6.x`
05/2016	Trung bình	CVE-2016-2107	`4.x · 5.x · 6.x`
	Cao	CVE-2015-3193	`5.x · 4.x`
	Cao	CVE-2015-3194	`5.x · 4.x`
	Cao	CVE-2015-6764	`5.x · 4.x`
	Cao	CVE-2015-7384	`4.x`
	Cao	CVE-2015-8027	`5.x · 4.x`
	Trung bình	CVE-2016-0702	`4.x · 5.x`
	Cao	CVE-2016-0797	`4.x · 5.x`
	Cao	CVE-2016-2086	`5.x · 4.x`
	Trung bình	CVE-2016-2178	`6.x · 5.x · 4.x`
	Cao	CVE-2016-2183	`6.x · 5.x · 4.x`
	Cao	CVE-2016-2216	`5.x · 4.x`
	Nghiêm trọng	CVE-2016-5180	`0.10.x · 0.12.x · 4.x`
	Trung bình	CVE-2016-5325	`6.x · 4.x · 5.x`
	Cao	CVE-2016-6303	`6.x · 5.x · 4.x`
	Cao	CVE-2016-6304	`6.x · 5.x · 4.x`
	Trung bình	CVE-2016-6306	`6.x · 5.x · 4.x`
	Trung bình	CVE-2016-7099	`6.x · 4.x · 5.x`
	Chưa xếp	CVE-2016-9551	`^7.1.0`
	Cao	CVE-2016-9840	`4.x · 5.x · 6.x · 7.x`
	Cao	CVE-2017-14919	`^4.8.2 · ^6.10.2 · 8.x`
	Cao	CVE-2019-15604	`10.x · 12.x · 13.x`
	Nghiêm trọng	CVE-2019-15605	`10.x · 12.x · 13.x`
	Cao	CVE-2019-15606	`10.x · 12.x · 13.x`
	Cao	CVE-2021-22931	`12.x · 14.x · 16.x`
	Thấp	CVE-2021-22939	`12.x · 14.x · 16.x`
	Cao	CVE-2021-22940	`12.x · 14.x · 16.x`
	Trung bình	CVE-2021-22959	`12.x · 14.x · 16.x`
	Cao	CVE-2021-37701	`12.x · 14.x`
	Trung bình	CVE-2021-44531	`12.x · 14.x · 16.x · 17.x`
	Trung bình	CVE-2021-44532	`12.x · 14.x · 16.x · 17.x`
	Trung bình	CVE-2021-44533	`12.x · 14.x · 16.x · 17.x`
	Cao	CVE-2022-0778	`12.x · 14.x · 16.x · 17.x`
	Thấp	CVE-2022-21824	`12.x · 14.x · 16.x · 17.x`
	Chưa xếp	nodejs-security-wg-17	`6.x`
	Chưa xếp	nodejs-security-wg-2	`4.x · 5.x · 6.x · 7.x · 8.x`
	Chưa xếp	nodejs-security-wg-20	`6.x · 4.x`
	Chưa xếp	nodejs-security-wg-21	`6.x · 5.x · 4.x`
	Chưa xếp	nodejs-security-wg-25	`5.x · 4.x · 6.x`
	Chưa xếp	nodejs-security-wg-26	`5.x · 4.x`
	Chưa xếp	nodejs-security-wg-29	`4.x · 5.x`
	Chưa xếp	nodejs-security-wg-30	`4.x · 5.x`
	Chưa xếp	nodejs-security-wg-33	`4.x · 5.x`
	Chưa xếp	nodejs-security-wg-38	`4.x · 6.x`
	Chưa xếp	nodejs-security-wg-39	`4.x`
	Chưa xếp	nodejs-security-wg-41	`4.x`

Lỗ hổng từ nodejs/security-wg (danh sách do chính dự án Node.js công bố), nhánh từ endoflife.date.