NO
Product
Node.js
On CISA KEVExploited in the wild
184
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 18High 101Medium 54Low 6
Watch
Add Node.js to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-48931 | 3.7 | Jun 22 | A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request Affected: 22.22.3; 24.16.0; 26.3.0 |
| CVE-2026-48936 | 3.3 | Jun 26 | A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission Affected: 26.3.0 |
| CVE-2026-48935 | 3.3 | Jun 26 | A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g Affected: 22.22.3; 24.16.0; 26.3.0 |
| CVE-2026-21716 | 3.3 | Mar 30 | An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based… Affected: through 20.20.1; 22.0.0 through 22.22.1; 24.0.0 through 24.14.0; 25.0.0 through 25.8.1 |
| CVE-2026-21715 | 3.3 | Mar 30 | A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions… Affected: through 20.20.1; 22.0.0 through 22.22.1; 24.0.0 through 24.14.0; 25.0.0 through 25.8.1 |
| CVE-2017-15897 | 3.1 | Dec 11 | Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified Affected: 8.0.0 through 8.8.1; 8.9.0 before 8.9.3; 9.0.0 before 9.2.1 |
Showing 6