NO
Product
node
55
CVEs
0
On KEV
9.8
Max CVSS
9
New 30D
Severity mix
Critical 1High 21Medium 20Low 13
Watch
Add node to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-48936 | 3.3 | Jun 26 | A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission Affected: 26.3.0 through 26.3.0 |
| CVE-2026-48935 | 3.3 | Jun 26 | A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g Affected: 22.22.3 through 22.22.3; 24.16.0 through 24.16.0; 26.3.0 through 26.3.0 |
| CVE-2026-21716 | 3.3 | Mar 30 | An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based… Affected: 20.20.1 through 20.20.1; 22.22.1 through 22.22.1; 24.14.0 through 24.14.0; 25.8.1 through 25.8.1 |
| CVE-2026-21715 | 3.3 | Mar 30 | A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions… Affected: 20.20.1 through 20.20.1; 22.22.1 through 22.22.1; 24.14.0 through 24.14.0; 25.8.1 through 25.8.1; 4.0 before 4.*; 5.0 before 5.*; +14 more |
| CVE-2024-36137 | 3.3 | Sep 7 | A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used Affected: 4.0 before 4.*; 5.0 before 5.*; 6.0 before 6.*; 7.0 before 7.*; 8.0 before 8.*; 9.0 before 9.*; +12 more |