CVE-2026-16221 | High | 7.5 | 2026-07-19 | Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character… |
CVE-2026-12590 | Low | 3.7 | 2026-07-09 | Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an un… |
CVE-2026-13676 | High | 7.5 | 2026-06-29 | fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that… |
CVE-2026-10796 | High | 7.5 | 2026-06-04 | nvm (Node Version Manager) through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. Commands such as `n… |
CVE-2026-25244 | Critical | 9.8 | 2026-05-18 | WebdriverIO is a test automation framework for unit, e2e and component testing using WebDriver, WebDriver BiDi and Appium. Versions below 9.24.0 contain a comm… |
CVE-2026-6322 | High | 7.5 | 2026-05-05 | fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A… |
CVE-2026-6321 | High | 7.5 | 2026-05-04 | fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path da… |
CVE-2025-50537 | Medium | 5.5 | 2026-01-26 | Stack overflow vulnerability in eslint before 9.26.0 when serializing objects with circular references in eslint/lib/shared/serialization.js. The exploit is tr… |
CVE-2025-57349 | High | 7.5 | 2025-09-24 | The messageformat package, an implementation of the Unicode MessageFormat 2 specification for JavaScript, is vulnerable to prototype pollution due to improper… |
CVE-2024-10491 | Medium | 4.0 | 2024-10-29 | A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data… |
CVE-2024-45590 | High | 7.5 | 2024-09-10 | body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a… |
CVE-2024-43800 | Medium | 5.0 | 2024-09-10 | serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is… |
CVE-2024-43796 | Medium | 5.0 | 2024-09-10 | Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute… |
CVE-2024-29900 | High | 7.5 | 2024-03-29 | Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready for distribution. A… |
CVE-2024-29041 | Medium | 6.1 | 2024-03-25 | Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open… |
CVE-2024-26136 | High | 7.5 | 2024-02-20 | kedi ElectronCord is a bot management tool for Discord. Commit aaaeaf4e6c99893827b2eea4dd02f755e1e24041 exposes an account access token in the `config.json` fi… |
CVE-2022-24999 | High | 7.5 | 2022-11-26 | qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ p… |
CVE-2020-4051 | Low | 3.7 | 2020-06-15 | In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and great… |
CVE-2014-6393 | Medium | 6.1 | 2017-08-09 | The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, whic… |
CVE-2015-8856 | Medium | 6.1 | 2017-01-23 | Cross-site scripting (XSS) vulnerability in the serve-index package before 1.6.3 for Node.js allows remote attackers to inject arbitrary web script or HTML via… |