NO
Product
Node.js
On CISA KEVExploited in the wild
184
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 18High 101Medium 54Low 6
Watch
Add Node.js to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-56850 | 4.4 | Jul 30 | A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with… Affected: 22.0 through 22.23.1; 24.0.0 through 24.18.0; 26.0.0 through 26.5.0 |
| CVE-2026-48934 | 4.3 | Jun 26 | A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation Affected: 22.22.3; 24.16.0; 26.3.0 |
| CVE-2018-12123 | 4.3 | Nov 28 | Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse()… Affected: 6.0.0 before 6.15.0; 8.0.0 before 8.14.0; 10.0.0 before 10.14.0; 11.0.0 before 11.3.0 |
| CVE-2023-23920 | 4.2 | Feb 23 | An untrusted search path vulnerability exists in Node.js Affected: 14.0.0 through 14.14.0; 14.0.0 before 14.21.3; 16.0.0 through 16.12.0; 16.0.0 before 16.19.1; 18.0.0 through 18.11.0; 18.0.0 before 18.14.1; +1 more |