NO
Vendor
Nodejs
301
CVEs
1
On KEV
18
New 30D
Products
NO9.8
node
nodejs
55 CVEs0 on KEV9 new
UN9.8
Undici
Nodejs
52 CVEs0 on KEV9 new
NO10.0
Node.js
Nodejs
184 CVEs1 on KEV0 new
NO8.1
Nodejs
Nodejs
10 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-106069 New | NO node nodejs | 7.4 | Oct 23 | A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a… |
| CVE-2026-105481 New | NO node nodejs | 6.5 | Oct 23 | A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request |
| CVE-2026-105482 New | NO node nodejs | 7.4 | Oct 23 | A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse() |
| CVE-2026-106074 New | NO node nodejs | 4.8 | Oct 23 | A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup… |
| CVE-2026-106071 New | NO node nodejs | 3.6 | Oct 23 | A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule |
| CVE-2026-106072 New | NO node nodejs | 6.7 | Oct 23 | A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling,… |
| CVE-2026-105483 New | NO node nodejs | 7.4 | Oct 23 | A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with… |
| CVE-2026-106070 New | NO node nodejs | 3.7 | Oct 23 | A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails |
| CVE-2026-106073 New | NO node nodejs | 3.3 | Oct 23 | A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks |
| CVE-2026-87029 | UN Undici Nodejs | 7.5 | Oct 15 | undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor |
| CVE-2026-109932 | UN Undici Nodejs | 7.5 | Oct 15 | undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering |
| CVE-2026-87018 | UN Undici Nodejs | 7.5 | Oct 15 | undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation |
| CVE-2026-109383 | UN Undici Nodejs | 9.1 | Oct 15 | undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent |
| CVE-2026-109829 | UN Undici Nodejs | 9.1 | Oct 15 | undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects |
| CVE-2026-109841 | UN Undici Nodejs | 7.5 | Oct 15 | undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens |
| CVE-2026-109924 | UN Undici Nodejs | 7.5 | Oct 15 | undici vulnerable to Denial of Service via unbounded memory in the EventSource parser |
| CVE-2026-109869 | UN Undici Nodejs | 7.5 | Oct 15 | undici vulnerable to Denial of Service via unhandled error on excessive content-encodings |
| CVE-2026-109855 | UN Undici Nodejs | 7.5 | Oct 15 | undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake |
| CVE-2026-18149 | UN Undici Nodejs | 5.9 | Sep 4 | undici vulnerable to Denial of Service via orphaned RetryHandler response body |
| CVE-2026-18540 | UN Undici Nodejs | 3.7 | Sep 4 | undici vulnerable to downstream response splitting via retry interceptor |
| CVE-2026-19534 | UN Undici Nodejs | 7.5 | Sep 4 | undici vulnerable to Denial of Service via unrequested WebSocket subprotocol |
| CVE-2026-84890 | UN Undici Nodejs | 5.9 | Sep 4 | undici vulnerable to Denial of Service via unbounded decompression of compressed responses |
| CVE-2026-84933 | UN Undici Nodejs | 8.2 | Sep 4 | undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches |
| CVE-2026-84947 | UN Undici Nodejs | 5.3 | Sep 4 | undici vulnerable to response truncation via oversized chunked responses in the dump interceptor |
| CVE-2026-84961 | UN Undici Nodejs | 9.1 | Sep 4 | undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool |
| CVE-2026-85008 | UN Undici Nodejs | 5.3 | Sep 4 | undici vulnerable to caching and replay of unsafe HTTP method responses |
| CVE-2026-85152 | UN Undici Nodejs | 7.4 | Sep 4 | undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors |
| CVE-2026-85014 | UN Undici Nodejs | 7.5 | Sep 4 | undici vulnerable to Denial of Service via WebSocketStream unclean close |
| CVE-2026-85024 | UN Undici Nodejs | 5.9 | Sep 4 | undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression |
| CVE-2026-48932 | NO node nodejs | 3.7 | Sep 1 | A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers… |
| CVE-2026-56848 | NO node nodejs | 7.5 | Aug 4 | A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free |
| CVE-2026-58042 | NO node nodejs | 5.9 | Aug 4 | A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records |
| CVE-2026-56846 | NO node nodejs | 7.5 | Aug 4 | A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion |
| CVE-2026-58044 | NO node nodejs | 3.7 | Aug 4 | A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers… |
| CVE-2026-58045 | NO node nodejs | 6.2 | Aug 4 | A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process to crash |
| CVE-2026-58041 | NO node nodejs | 5.3 | Aug 4 | A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has… |
| CVE-2026-58039 | NO node nodejs | 3.3 | Jul 31 | A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths |
| CVE-2026-56847 | NO node nodejs | 6.1 | Jul 30 | A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write` |
| CVE-2026-58043 | NO node nodejs | 8.4 | Jul 30 | A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries |
| CVE-2026-56850 | NO node nodejs | 4.4 | Jul 30 | A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with… |
| CVE-2026-58040 | NO node nodejs | 6.3 | Jul 30 | An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934) |
| CVE-2026-15157 | UN Undici Nodejs | 5.4 | Jul 29 | undici vulnerable to CRLF Injection via blob-like body 'type' property |
| CVE-2026-14643 | UN Undici Nodejs | 7.5 | Jul 29 | undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives |
| CVE-2026-16728 | UN Undici Nodejs | 6.5 | Jul 29 | undici vulnerable to downstream response desynchronization via retry interceptor |
| CVE-2026-16729 | UN Undici Nodejs | 6.5 | Jul 29 | undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields |
| CVE-2026-13697 | UN Undici Nodejs | 9.1 | Jul 29 | undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives |
| CVE-2026-48930 | NO node nodejs | 9.8 | Jun 26 | A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings |
| CVE-2026-48928 | NO node nodejs | 5.4 | Jun 26 | A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups |
| CVE-2026-48934 | NO node nodejs | 4.3 | Jun 26 | A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation |
| CVE-2026-48936 | NO node nodejs | 3.3 | Jun 26 | A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission |
| CVE-2026-48618 | NO node nodejs | 6.5 | Jun 26 | A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname… |
| CVE-2026-48933 | NO node nodejs | 7.5 | Jun 26 | A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB |
| CVE-2026-48935 | NO node nodejs | 3.3 | Jun 26 | A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g |
| CVE-2026-48619 | NO node nodejs | 7.5 | Jun 26 | A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client |
| CVE-2026-48615 | NO node nodejs | 7.5 | Jun 26 | A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages |
| CVE-2026-48931 | NO node nodejs | 3.7 | Jun 22 | A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request |
| CVE-2026-48937 | NO node nodejs | 7.5 | Jun 18 | A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame |
| CVE-2026-48617 | NO node nodejs | 8.2 | Jun 18 | A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation |
| CVE-2026-11525 | UN Undici Nodejs | 3.7 | Jun 17 | undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching |
| CVE-2026-6733 | UN Undici Nodejs | 3.7 | Jun 17 | undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse |