NO
Product
Nodejs
10
CVEs
0
On KEV
8.1
Max CVSS
0
New 30D
Severity mix
Critical 0High 5Medium 2Low 0
Watch
Add Nodejs to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-36138 | 8.1 | Sep 7 | Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn /… Affected: 18.0 before 18.20.4; 20.0 before 20.15.1; 22.0 before 22.4.1 |
| CVE-2023-30584 | 7.7 | Sep 7 | A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model Affected: 20.0 before 20.3.1 |
| CVE-2023-30587 | 7.5 | Sep 7 | A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module (node:inspector) Affected: 20.0 before 20.3.1 |
| CVE-2023-30583 | 7.5 | Sep 7 | fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the `--allow-fs-read` flag in Node.js 20 Affected: 20.0 before 20.3.1 |
| CVE-2023-46809 | 7.4 | Sep 7 | Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack -… Affected: 18.0 through 18.19.0; 20.0 through 20.11.0; 21.0 through 21.6.0 |
| CVE-2023-39333 | 5.3 | Sep 7 | Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code Affected: 18.0 before 18.18.2; 20.0 before 20.8.1 |
| CVE-2023-30582 | 5.3 | Sep 7 | A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument Affected: 20.0 before 20.3.1 |
| CVE-2014-5256 | – | Sep 5 | Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction with a V8 interrupt,… Affected: 0.8.0; 0.8.1; 0.8.2; 0.8.3; 0.8.4; 0.8.5; +34 more |
| CVE-2013-4450 | – | Oct 21 | The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large… Affected: 0.8.0; 0.8.1; 0.8.2; 0.8.3; 0.8.4; 0.8.5; +34 more |
| CVE-2012-2330 | – | Aug 13 | The Update method in src/node_http_parser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string, which allows remote attackers to obtain… Affected: through 0.6.16; 0.7.0; 0.7.1; 0.7.2; 0.7.3; 0.7.4; +3 more |
Showing 10