Nodejs Node
108 CVEs affecting Nodejs Node. Latest disclosed: 2026-06-26. Critical: 11, High: 52.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-21636 | Critical | 10.0 | 2026-01-20 | A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `-… |
CVE-2026-48930 | Critical | 9.8 | 2026-06-26 | A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings… |
CVE-2024-21896 | Critical | 9.8 | 2024-02-20 | The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a… |
CVE-2023-39332 | Critical | 9.8 | 2023-10-18 | Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Arr… |
CVE-2023-32002 | Critical | 9.8 | 2023-08-21 | The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability a… |
CVE-2021-22930 | Critical | 9.8 | 2021-10-07 | Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to chang… |
CVE-2021-22931 | Critical | 9.8 | 2021-08-16 | Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names retu… |
CVE-2019-15606 | Critical | 9.8 | 2020-02-07 | Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons |
CVE-2019-15605 | Critical | 9.8 | 2020-02-07 | HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed |
CVE-2025-55130 | Critical | 9.1 | 2026-01-20 | A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By… |
CVE-2022-35255 | Critical | 9.1 | 2022-12-05 | A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/c… |
CVE-2024-21891 | High | 8.8 | 2024-02-20 | Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementati… |
CVE-2023-32006 | High | 8.8 | 2023-08-15 | The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. … |
CVE-2023-32004 | High | 8.8 | 2023-08-15 | A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buf… |
CVE-2024-27983 | High | 8.2 | 2024-04-09 | An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is… |
CVE-2022-21824 | High | 8.2 | 2022-02-24 | Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while s… |
CVE-2024-27980 | High | 8.1 | 2025-01-09 | Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands a… |
CVE-2024-36138 | High | 8.1 | 2024-09-07 | Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn / ch… |
CVE-2022-43548 | High | 8.1 | 2022-12-05 | A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easil… |
CVE-2022-32212 | High | 8.1 | 2022-07-14 | A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypas… |