| 2026-10 | Moderate | CVE-2026-105481 | Keep-alive socket process a response that was written before the request was sent | 22.x · 24.x · 26.x |
| 2026-10 | High | CVE-2026-105482 | dns.resolve truncates names containing NUL char | 22.x · 24.x · 26.x |
| 2026-10 | High | CVE-2026-105483 | TLS certificate hostname bypass when the IP is written fullwidth digits | 24.x · 26.x |
| 2026-10 | High | CVE-2026-106069 | TLS certificate hostname bypass when the host loosely resolves to an IP address | 22.x · 24.x · 26.x |
| 2026-10 | Low | CVE-2026-106070 | Node.js ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation | 26.x |
| 2026-10 | Low | CVE-2026-106071 | Permission Model filesystem over-grant via wildcard radix lookup | 26.x |
| 2026-10 | Moderate | CVE-2026-106072 | Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints | 22.x · 24.x · 26.x |
| 2026-10 | Low | CVE-2026-106073 | Permission Model bypass with fs.realpathSync | 22.x · 24.x · 26.x |
| 2026-10 | Moderate | CVE-2026-106074 | crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values | 22.x · 24.x · 26.x |
| 2026-10 | High | CVE-2026-111497 | Node.js Brotli decoder out-of-bounds write permits remote code execution | 22.x · 24.x · 26.x |
| 2026-07 | High | CVE-2026-56846 | HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion | 22.x · 24.x |
| 2026-07 | Low | CVE-2026-56847 | Permission Model Bypass: `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write` | 22.x · 24.x · 26.x |
| 2026-07 | High | CVE-2026-56848 | Re-entrant `nghttp2_session_mem_send()` during `nghttp2_session_mem_recv()` causes heap-use-after-free in Node.js HTTP/2 | 22.x · 24.x · 26.x |
| 2026-07 | Moderate | CVE-2026-56850 | HTTPS Agent PFX object-array key collision allows mTLS client identity reuse across different per-request certificates | 22.x · 24.x · 26.x |
| 2026-07 | Low | CVE-2026-58039 | Permission Model bypass: process.report writes (and overwrites) files outside --allow-fs-write paths | 22.x · 24.x · 26.x |
| 2026-07 | Moderate | CVE-2026-58040 | HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934) | 22.x · 24.x · 26.x |
| 2026-07 | Moderate | CVE-2026-58041 | node:sqlite SQLTagStore Iterator Replay Lets Attacker Re-Execute Victim-Bound Writes Indefinitely | 24.x · 26.x |
| 2026-07 | Moderate | CVE-2026-58042 | dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records | 22.x · 24.x · 26.x |
| 2026-07 | High | CVE-2026-58043 | Permission Model: --allow-fs-read/--allow-fs-write radix-tree prefix-boundary over-grant | 22.x · 24.x · 26.x |
| 2026-07 | Low | CVE-2026-58044 | HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP Parser | 22.x · 24.x · 26.x |
| 2026-07 | Moderate | CVE-2026-58045 | Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected) | 22.x · 24.x · 26.x |
| 2026-06 | Moderate | CVE-2026-48615 | Proxy credentials leaked in ERR_PROXY_TUNNEL error message | 22.x · 24.x · 26.x |
| 2026-06 | Low | CVE-2026-48617 | Permission Model Bypass via `process.report.writeReport()` Path Misvalidation | 22.x · 24.x · 26.x |
| 2026-06 | High | CVE-2026-48618 | Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat | 22.x · 24.x · 26.x |
| 2026-06 | Moderate | CVE-2026-48619 | Unbounded memory growth in `node:http2` clients via attacker-controlled ORIGIN frames | 22.x · 24.x · 26.x |
| 2026-06 | Moderate | CVE-2026-48928 | Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching | 22.x · 24.x · 26.x |
| 2026-06 | Moderate | CVE-2026-48930 | Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings | 22.x · 24.x · 26.x |
| 2026-06 | Low | CVE-2026-48931 | HTTP Response Queue Poisoning via TOCTOU Race Condition in `http.Agent` | 22.x · 24.x · 26.x |
| 2026-06 | High | CVE-2026-48933 | Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (DoS) | 22.x · 24.x · 26.x |
| 2026-06 | Moderate | CVE-2026-48934 | TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections | 22.x · 24.x · 26.x |
| 2026-06 | Low | CVE-2026-48935 | Permission Model bypass via FileHandle.utimes() in the promises API | 22.x · 24.x · 26.x |
| 2026-06 | Low | CVE-2026-48936 | Unix domain socket server bypasses --permission network restrictions (incomplete CVE-2026-21636 fix) | 26.x |
| 2026-06 | Moderate | CVE-2026-48937 | HTTP/2 sessions never clean up after GOAWAY on invalid protocol errors | 22.x · 24.x |
| 2026-03 | High | CVE-2026-21637 | Incomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoS | 20.x · 22.x · 24.x · 25.x |
| 2026-03 | High | CVE-2026-21710 | Denial of Service via `__proto__` header name in `req.headersDistinct` (Uncaught `TypeError` crashes Node.js process) | 20.x · 22.x · 24.x · 25.x |
| 2026-03 | Moderate | CVE-2026-21711 | Node.js Permission Model bypass: UDS server bind/listen works without `--allow-net` | 25.x |
| 2026-03 | Moderate | CVE-2026-21712 | Assertion error in node_url.cc via malformed URL format leads to Node.js crash | 24.x · 25.x |
| 2026-03 | Moderate | CVE-2026-21713 | Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery | 20.x · 22.x · 24.x · 25.x |
| 2026-03 | Moderate | CVE-2026-21714 | Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion | 20.x · 22.x · 24.x · 25.x |
| 2026-03 | Low | CVE-2026-21715 | Permission Model Bypass in realpathSync.native Allows File Existence Disclosure | 20.x · 22.x · 24.x · 25.x |
| 2026-03 | Low | CVE-2026-21716 | CVE-2024-36137 Patch Bypass - FileHandle.chmod/chown | 20.x · 22.x · 24.x · 25.x |
| 2026-03 | Moderate | CVE-2026-21717 | HashDoS in V8 | 20.x · 22.x · 24.x · 25.x |
| 2025-12 | High | CVE-2025-55130 | FS Permissions Bypass | 20.x · 22.x · 24.x · 25.x |
| 2025-12 | High | CVE-2025-55131 | Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled | 20.x · 22.x · 24.x · 25.x |
| 2025-12 | Low | CVE-2025-55132 | fs.futimes() Bypasses Read-Only Permission Model | 20.x · 22.x · 24.x · 25.x |
| 2025-12 | Moderate | CVE-2025-59464 | Memory leak that enables remote Denial of Service against applications processing TLS client certificates | 20.x · 22.x · 24.x |
| 2025-12 | High | CVE-2025-59465 | Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame | 20.x · 22.x · 24.x · 25.x |
| 2025-12 | Moderate | CVE-2025-59466 | Uncatchable "Maximum call stack size exceeded" error on Node.js via async_hooks leads to process crashes bypassing error handlers | 20.x · 22.x · 24.x · 25.x |
| 2025-12 | Moderate | CVE-2026-21636 | Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS) | 25.x |
| 2025-07 | High | CVE-2025-27209 | HashDoS in V8 | 24.x |
| 2025-07 | High | CVE-2025-27210 | Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize() | 20.x · 22.x · 24.x |
| 2025-05 | Low | CVE-2025-23165 | Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string. | 20.x · 22.x |
| 2025-05 | High | CVE-2025-23166 | Improper error handling in async cryptographic operations crashes process | 20.x · 22.x · 23.x · 24.x |
| 2025-05 | Moderate | CVE-2025-23167 | Improper HTTP header block termination in llhttp | 20.x |
| 2025-01 | High | CVE-2025-23083 | Worker permission bypass via InternalWorker leak in diagnostics | 20.x · 22.x · 23.x |
| 2025-01 | Moderate | CVE-2025-23084 | Path traversal by drive name in Windows environment | 18.x · 20.x · 22.x · 23.x |
| 2025-01 | Moderate | CVE-2025-23085 | GOAWAY HTTP/2 frames cause memory leak outside heap | 18.x · 20.x · 22.x · 23.x |
| 2024-07 | Low | CVE-2024-22018 | fs.lstat bypasses permission model | 20.x · 22.x |
| 2024-07 | Moderate | CVE-2024-22020 | Bypass network import restriction via data URL | 18.x · 20.x · 22.x |
| 2024-07 | Low | CVE-2024-36137 | fs.fchown/fchmod bypasses permission model | 20.x · 22.x |
| 2024-07 | High | CVE-2024-36138 | Bypass incomplete fix of CVE-2024-27980 | 18.x · 20.x · 22.x |
| 2024-07 | Low | CVE-2024-37372 | Permission model improperly processes UNC paths | 20.x · 22.x |
| 2024-04 | High | CVE-2024-27980 | Command injection via args parameter of child_process.spawn without shell option enabled on Windows | 18.x · 20.x · 21.x |
| 2024-04 | High | CVE-2024-27980 | Command injection via args parameter of child_process.spawn without shell option enabled on Windows | 18.x · 20.x · 21.x |
| 2024-04 | Moderate | CVE-2024-27982 | HTTP Request Smuggling via Content Length Obfuscation | 18.x · 20.x · 21.x |
| 2024-04 | High | CVE-2024-27983 | Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash | 18.x · 20.x · 21.x |
| 2024-02 | Moderate | CVE-2023-46809 | A vulnerability in the privateDecrypt() API of the crypto library, allowed a covert timing side-channel during PKCS#1 v1.5 padding error handling. | 18.x · 20.x · 21.x |
| 2024-02 | Moderate | CVE-2024-21890 | Improper handling of wildcards in --allow-fs-read and --allow-fs-write | 20.x · 21.x |
| 2024-02 | Moderate | CVE-2024-21891 | Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission model bypass through path traversal attack. | 20.x · 21.x |
| 2024-02 | High | CVE-2024-21892 | Code injection and privilege escalation through Linux capabilities | 18.x · 20.x · 21.x |
| 2024-02 | High | CVE-2024-21896 | The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve(). | 20.x · 21.x |
| 2024-02 | High | CVE-2024-22017 | setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid() | 20.x · 21.x |
| 2024-02 | High | CVE-2024-22019 | A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). | 18.x · 20.x · 21.x |
| 2024-02 | Moderate | CVE-2024-22025 | A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetch() function to retrieve content from an untrusted URL. | 18.x · 20.x · 21.x |
| 2023-10 | Moderate | CVE-2023-38552 | Integrity checks according to experimental policies can be circumvented (Medium) | 18.x · 20.x |
| 2023-10 | High | CVE-2023-39331 | A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently. The implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations (High) | 20.x |
| 2023-10 | High | CVE-2023-39332 | Path traversal through path stored in Uint8Array (High) | 20.x |
| 2023-10 | Low | CVE-2023-39333 | Code injection via WebAssembly export names (Low) | 18.x · 20.x |
| 2023-10 | High | CVE-2023-44487 | Rapidly creating and cancelling streams (HEADERS frame immediately followed by RST_STREAM) without bound causes denial of service (High) | 18.x · 20.x |
| 2023-10 | Low | CVE-2023-45143 | Cookie headers are not cleared in cross-domain redirect in undici-fetch (High) | 18.x · 20.x |
| 2023-08 | High | CVE-2023-32002 | The use of Module._load() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. | 16.x · 18.x · 20.x |
| 2023-08 | Moderate | CVE-2023-32003 | fs.mkdtemp() and fs.mkdtempSync() can be used to bypass the permission model check using a path traversal attack. | 20.x |
| 2023-08 | High | CVE-2023-32004 | Improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions. | 20.x |
| 2023-08 | Moderate | CVE-2023-32005 | A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument. | 20.x |
| 2023-08 | High | CVE-2023-32006 | The use of module.constructor.createRequire() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. | 16.x · 18.x · 20.x |
| 2023-08 | High | CVE-2023-32558 | The use of the deprecated API process.binding() can bypass the permission model through path traversal. | 20.x |
| 2023-08 | High | CVE-2023-32559 | The use of the deprecated API process.binding() can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding('spawn_sync') run arbitrary code, outside of the limits defined in a policy.json file. | 16.x · 18.x · 20.x |
| 2023-06 | High | CVE-2023-30581 | The use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules outside of the policy.json definition | 16.x · 18.x · 20.x |
| 2023-06 | Moderate | CVE-2023-30582 | A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument. | 20.x |
| 2023-06 | Moderate | CVE-2023-30583 | fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the --allow-fs-read flag in Node.js 20 | 20.x |
| 2023-06 | High | CVE-2023-30584 | A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions. | 20.x |
| 2023-06 | Moderate | CVE-2023-30585 | Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process | 16.x · 18.x · 20.x |
| 2023-06 | Moderate | CVE-2023-30586 | Node.js 20 allows loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model. | 20.x |
| 2023-06 | High | CVE-2023-30587 | A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module (node:inspector). | 20.x |
| 2023-06 | Moderate | CVE-2023-30588 | When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs. | 16.x · 18.x · 20.x |
| 2023-06 | Moderate | CVE-2023-30589 | The llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. | 16.x · 18.x · 20.x |
| 2023-06 | Moderate | CVE-2023-30590 | The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet. | 16.x · 18.x · 20.x |
| 2023-02 | High | CVE-2023-23918 | It was possible to bypass Permissions and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy. | 14.x · 16.x · 18.x · 19.x |
| 2023-02 | Moderate | CVE-2023-23919 | In some cases Node.js did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service. | 14.x · 16.x · 18.x · 19.x |
| 2023-02 | Low | CVE-2023-23920 | Node.js would search and potentially load ICU data when running with elevated priviledges. Node.js was modified to build with ICU_NO_USER_DATA_OVERRIDE to avoid this. | 14.x · 16.x · 18.x · 19.x |
| 2023-02 | Moderate | CVE-2023-23936 | The fetch API in Node.js did not prevent CRLF injection in the 'host' header potentially allowing attacks such as HTTP response splitting and HTTP header injection. | 14.x · 16.x · 18.x · 19.x |
| 2023-02 | Low | CVE-2023-24807 | The Headers.set() and Headers.append() methods in the fetch API in Node.js where vulnerable to Regular a Expression Denial of Service (ReDoS) attacks. | 14.x · 16.x · 18.x · 19.x |
| 2022-11 | Moderate | CVE-2022-43548 | The Node.js rebinding protector for --inspect still allows invalid IP address, specifically, the octal format. | 14.x · 16.x · 18.x · 19.x |
| 2022-09 | High | CVE-2022-32212 | The IsAllowedHost check in https://github.com/nodejs/node/blob/fdf0a84e826d3a9ec0ce6f5a3f5adc967fe99408/src/inspector_socket.cc#L580 can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid or not. When an invalid IPv4 address is provided (for instance 10.0.2.555 is provided), the browser will make a DNS requests to the DNS server, providing a vector for an at | 14.x · 16.x · 18.x |
| 2022-09 | Moderate | CVE-2022-32213 | The llhttp parser in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS). | 14.x · 16.x · 18.x |
| 2022-09 | Moderate | CVE-2022-32215 | The llhttp parser in the http module in Node does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS). | 14.x · 16.x · 18.x |
| 2022-09 | Moderate | CVE-2022-32222 | On linux, versions of 18.x prior to Y used a default path for openssl.cnf that was within a path that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3. | 14.x · 16.x · 18.x |
| 2022-09 | High | CVE-2022-35255 | Node.js made calls to EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. However, it does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. | 18.x |
| 2022-09 | Moderate | CVE-2022-35256 | The llhttp parser in the http module in Node.js v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling. | 14.x · 16.x · 18.x |
| 2022-07 | Moderate | CVE-2022-32214 | The llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). | 14.x · 16.x · 18.x |
| 2022-07 | High | CVE-2022-32223 | Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms. This vulnerability can be exploited if the victim has the following dependencies on a Windows machine: * OpenSSL has been installed and “C:\Program Files\Common Files\SSL\openssl.cnf” exists. Whenever the above conditions are present, `node.exe` will search for `providers.dll` in the curren | 14.x · 16.x · 18.x |
| 2021-07 | Moderate | CVE-2021-22918 | Node.js is vulnerable to out-of-bounds read in libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22918 | 12.x · 14.x · 16.x |
| 2021-07 | Moderate | CVE-2021-22921 | Node.js is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22921 | 12.x · 14.x · 16.x |
| 2021-07 | High | CVE-2021-22930 | Node.js before is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22930 | 12.x · 14.x · 16.x |
| 2021-07 | Moderate | CVE-2021-23362 | This is a vulnerability in the hosted-git-info npm module which may be vulnerable to denial of service attacks. You can read more about it in https://nvd.nist.gov/vuln/detail/CVE-2021-23362 | 12.x |
| 2021-07 | High | CVE-2021-27290 | This is a vulnerability in the ssri npm module which may be vulnerable to denial of service attacks. You can read more about it in https://github.com/advisories/GHSA-vx3p-948g-6vhq | 12.x |
| 2021-04 | High | CVE-2020-7774 | This is a vulnerability in the y18n npm module which may be exploited by prototype pollution. You can read more about it in https://github.com/advisories/GHSA-c4w7-xm78-47vh | 10.x · 12.x · 14.x |
| 2021-04 | High | CVE-2021-3449 | This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210325.txt | 10.x · 12.x · 14.x · 15.x |
| 2021-04 | High | CVE-2021-3450 | This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210325.txt | 10.x · 12.x · 14.x · 15.x |
| 2021-02 | Critical | CVE-2021-22883 | HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion - Affected Node.js versions are vulnerable to denial of service attacks when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also f | 10.x · 12.x · 14.x · 15.x |
| 2021-02 | High | CVE-2021-22884 | DNS rebinding in --inspect - Affected Node.js versions are vulnerable to denial of service attacks when the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the | 10.x · 12.x · 14.x · 15.x |
| 2021-02 | High | CVE-2021-23840 | OpenSSL - Integer overflow in CipherUpdate - This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210216.txt | 10.x · 12.x · 14.x · 15.x |
| 2021-01 | Moderate | CVE-2020-1971 | OpenSSL - EDIPARTYNAME NULL pointer de-reference - This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20201208.txt | 10.x · 12.x · 14.x · 15.x |
| 2021-01 | High | CVE-2020-8265 | use-after-free in TLSWrap - affected Node.js versions are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structur | 10.x · 12.x · 14.x · 15.x |
| 2021-01 | Low | CVE-2020-8287 | HTTP Request Smuggling in nodejs - Affected versions of Node.js allow two copies of a header field in a http request. For example, two Transfer-Encoding header fields. In this case Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling (https://cwe.mitre.org/data/definitions/444.html) | 10.x · 12.x · 14.x · 15.x |