Nodejs
Vulnerability activity for Nodejs: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 9
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 10
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 10
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 7.4HighOct 23, 2026Nodejs node Crypto / certificateCVE-2026-106069A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`. `tls.checkServerIdentity()` normalizes the host fo
- 6.5MediumOct 23, 2026Nodejs nodeCVE-2026-105481A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loo
- 7.4HighOct 23, 2026Nodejs node Auth bypass / access controlCVE-2026-105482A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a
- 4.8MediumOct 23, 2026Nodejs node Crypto / certificateCVE-2026-106074A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`. If any of these functions, or
- 3.6LowOct 23, 2026Nodejs node Auth bypass / access controlCVE-2026-106071A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a
- 6.7MediumOct 23, 2026Nodejs node Crypto / certificateCVE-2026-106072A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`. `tls.checkServerIdentity()` did not classify these hosts as
- 7.4HighOct 23, 2026Nodejs node Crypto / certificateCVE-2026-105483A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`). `tls.checkServerIdentity()` did not recognize such hosts as
- 3.7LowOct 23, 2026Nodejs nodeCVE-2026-106070A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When `zipEntry.modified` is read on an archive whose local header does not match its central directory, either directly or while compa
- 3.3LowOct 23, 2026Nodejs node Auth bypass / access controlCVE-2026-106073A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`. As a result, code running under `--permission` with restricted `--allow-fs-re
- 7.5HighAug 4, 2026Nodejs node Memory corruptionCVE-2026-56848A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
- 7.5HighFeb 23, 2023Nodejs node.js Crypto / certificateCVE-2023-23919A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.2.2% likely
- 7.5HighFeb 23, 2023Nodejs node.js Auth bypass / access controlCVE-2023-23918A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.2% likely
Top products
- node10 CVEs in the last year
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- Cisco PSIRT · Oct 28, 2026Vulnerabilities in Node.js Affecting Cisco Products: October 2026CVE-2026-105482CVE-2026-105483CVE-2026-106069
- Cisco PSIRT · Oct 27, 2026Vulnerabilities in node.js Affecting Cisco Products: October 2026CVE-2026-105482CVE-2026-105483CVE-2026-106069
- Fortinet PSIRT · Oct 26, 2026Multiple Node.js CVEsCVE-2026-105481CVE-2026-105482CVE-2026-105483CVE-2026-106069CVE-2026-106070CVE-2026-106071
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.