Node.js CVE feed and alerts
Every new CVE and security advisory affecting Node.js, merged from the CVE List, GitHub, OSV, NVD and CISA KEV into one entry each, with severity, exploitation status and fixed versions. New entries appear within minutes of their source. The feeds are free and need no API key; the newest 200 are listed below.
- Critical
- 11
- High
- 73
- On CISA KEV
- 0
Of the newest 174
- CVE-2026-126051Node.js remote denial of service in TLS handshakesnodejs node
- CVE-2026-123875Node.js denial of service in HTTP/2 file responsesnodejs node
- CVE-2026-123874Node.js remote memory corruption in HTTP/2 file servingnodejs node
- CVE-2026-123872Node.js client certificate auth bypass in TLS renegotiationnodejs node
- CVE-2026-123877Node.js certificate validation bypass in https.Agentnodejs node
- CVE-2026-123871Node.js credential disclosure in proxy error messagesnodejs node
- CVE-2026-123868Node.js denial of service in HTTP/2 DATA frame handlingnodejs node
- CVE-2026-123867Node.js per-host mTLS authorization bypass in SNI contextsnodejs node
- CVE-2026-123866Node.js memory disclosure via use-after-free in HTTP/2 streamsnodejs node
- CVE-2026-123865Node.js denial of service via leak in HTTP/2 sessionsnodejs node
- CVE-2026-123864Node.js cross-connection memory leak in HTTPS request parsernodejs node
- CVE-2026-123863Node.js remote denial of service in HTTP/2 session teardownnodejs node
- CVE-2026-123862Node.js denial of service in zlib stream destroynodejs node
- CVE-2026-123829Node.js file name disclosure in Permission Model fs.watchnodejs node
- CVE-2026-123828Node.js remote memory corruption in HTTP/2 altsvc handlingnodejs node
- CVE-2026-106069Node.js certificate validation bypass in TLS hostname checksnodejs node
- CVE-2026-105481Node.js response spoofing in HTTP Agent connection reusenodejs node
- CVE-2026-105482Node.js allowlist bypass via NUL-byte truncation in DNS resolutionnodejs node
- CVE-2026-106074Node.js predictable random values in crypto's entropy cachenodejs node
- CVE-2026-106071Node.js filesystem access bypass in Permission Modelnodejs node
- CVE-2026-106072Node.js server spoofing via flawed TLS hostname checksnodejs node
- CVE-2026-105483Node.js TLS hostname check bypass for IPv4 hostsnodejs node
- CVE-2026-106070Node.js mismatched entry data in zlib.ZipFilenodejs node
- CVE-2026-106073Node.js permission model bypass via fs.realpathSyncnodejs node
- CVE-2026-48932A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the…nodejs node
- CVE-2026-56848A flaw in Node.js HTTP/2 handling allows nghttp2_session_mem_send() to be called re-entrantly while nghttp2_session_mem_recv() is executing, resulting in a heap-use-after-freenodejs node
- CVE-2026-58042A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Recordsnodejs node
- CVE-2026-56846A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustionnodejs node
- CVE-2026-58044A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the…nodejs node
- CVE-2026-58045A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the synchronous node:zlib APIs, causing the entire process to crashnodejs node
- CVE-2026-58041A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound…nodejs node
- CVE-2026-58039A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write pathsnodejs node
- CVE-2026-56847A flaw in Node.js Permission Model enforcement allows trace_events.createTracing().enable() Writes Trace Logs Outside --allow-fs-writenodejs node
- CVE-2026-58043A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundariesnodejs node
- CVE-2026-56850A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client…nodejs node
- CVE-2026-58040An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934)nodejs node
- CVE-2026-48930A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindingsnodejs node
- CVE-2026-48928A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setupsnodejs node
- CVE-2026-48934A flaw in Node.js TLS host verification can cause an attacker to bypass certification validationnodejs node
- CVE-2026-48936A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the --allow-net permissionnodejs node
- CVE-2026-48618A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatnodejs node
- CVE-2026-48933A flaw in Node.js WebCrypto implementation can crash the process if the input of subtle.encrypt() is a multiple of 2GiBnodejs node
- CVE-2026-48935A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. --allow-fs-readnodejs node
- CVE-2026-48619A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the clientnodejs node
- CVE-2026-48615A flaw in Node.js proxy tunnel error handling could expose proxy credentials in ERR_PROXY_TUNNEL error messagesnodejs node
- CVE-2026-48931A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the requestnodejs node
- CVE-2026-48937A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a GOAWAY framenodejs node
- CVE-2026-48617A flaw in Node.js Permission Model enforcement allows Bypass via process.report.writeReport() Path Misvalidationnodejs node
- CVE-2026-21710A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request is received with a header named proto and the application accesses req.headersDistinctnodejs node
- CVE-2026-21716An incomplete fix for CVE-2024-36137 leaves FileHandle.chmod() and FileHandle.chown() in the promises API without the required permission checks, while their callback-based equivalents (fs.fchmod()…nodejs node
- CVE-2026-21711A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce…nodejs node
- CVE-2026-21715A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync.native() without the required read permission checks, while all comparable filesystem functions correctly enforce themnodejs node
- CVE-2026-21717A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictablenodejs node
- CVE-2026-21713A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytesnodejs node
- CVE-2026-21714A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1nodejs node
- CVE-2026-21712A flaw in Node.js URL processing causes an assertion failure in native code when url.format() is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing…nodejs node
- CVE-2026-21636A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when --permission is enablednodejs node
- CVE-2025-59466We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when async_hooks.createHook() is enablednodejs node
- CVE-2025-55132A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via futimes() even when the process has only read permissionsnodejs node
- CVE-2025-59464A memory leak in Node.js’s OpenSSL integration occurs when converting X.509 certificate fields to UTF-8 without freeing the allocated buffernodejs node
- CVE-2025-55131A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the vm module with the timeout optionnodejs node
- CVE-2025-55130A flaw in Node.js’s Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write restrictions using crafted relative symlink pathsnodejs node
- CVE-2026-21637A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when pskCallback or ALPNCallback are in usenodejs node
- CVE-2025-59465A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash by triggering an unhandled TLSSocket error ECONNRESETnodejs node
- CVE-2026-22036Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustionnodejs undici · undici
- CVE-2025-11149This affects all versions of the package node-static; all versions of the package @nubosoftware/node-staticnode-static · @nubosoftware/node-static
- CVE-2025-27210An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUXnodejs node · nodejs
- CVE-2025-27209The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhashnodejs node
- CVE-2025-23165In Node.js, the ReadFileUtf8 internal binding leaks memory due to a corrupted pointer in uv_fs_s.file: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is setnodejs node
- CVE-2025-23166The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js processnodejs node
- CVE-2025-23167A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\nnodejs node
- CVE-2025-47279undici Denial of Service attack via bad certificate datanodejs undici · undici
- CVE-2025-23085A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notificationNodeJS Node
- CVE-2025-23084A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environmentNodeJS Node
- CVE-2025-23083With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is createdNodeJS Node
- CVE-2025-22150Undici Uses Insufficiently Random Valuesnodejs undici · undici
- CVE-2024-27980Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the…NodeJS Node
- CVE-2024-37372The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always trueNodeJS Node
- CVE-2024-21528All versions of the package node-gettext are vulnerable to Prototype Pollution via the addTranslations() function in gettext.js due to improper user input sanitizationnode-gettext
- CVE-2023-46809Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack…NodeJS Node
- CVE-2024-36138Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn / child_process.spawnSyncNodeJS Node
- CVE-2023-39333Maliciously crafted export names in an imported WebAssembly module can inject JavaScript codeNodeJS Node
- CVE-2024-36137A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is usedNodeJS Node
- CVE-2023-30582A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non- argumentNodeJS Node
- CVE-2023-30587A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module (node:inspector)NodeJS Node
- CVE-2023-30583fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the --allow-fs-read flag in Node.js 20NodeJS Node
- CVE-2023-30584A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission modelNodeJS Node
- CVE-2024-21525All versions of the package node-twain are vulnerable to Improper Check or Handling of Exceptional Conditions due to the length of the source data not being checkednode-twain
- CVE-2024-22018A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is usedNodeJS Node
- CVE-2024-22020A security flaw in Node.js allows a bypass of network import restrictionsNodeJS Node
- CVE-2024-38372Undici vulnerable to data leak when using response.arrayBuffer()nodejs undici · undici
- CVE-2024-27982The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smugglingNodeJS Node
- CVE-2024-3566A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfiedNode.js · Go Programming Language GoLang +1
- CVE-2024-27983An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames insideNodeJS Node
- CVE-2024-30260Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipelinenodejs undici · undici
- CVE-2024-30261Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrectnodejs undici · undici
- CVE-2024-22025A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetch() function to retrieve content from an untrusted URLNodeJS Node
- CVE-2024-22017setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid()NodeJS Node
- CVE-2024-21896The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the userNodeJS Node
- CVE-2024-21890The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file pathNodeJS Node
- CVE-2024-21891Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission…NodeJS Node
- CVE-2024-22019A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS)NodeJS Node
- CVE-2024-21892On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of…NodeJS Node
- CVE-2024-24750Backpressure request ignored in fetch() in Undicinodejs undici · undici
- CVE-2024-24758Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undicinodejs undici · undici
- CVE-2023-30590The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the…NodeJS Node · node +1
- CVE-2023-30588When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could…NodeJS Node · node +1
- CVE-2023-30585A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install Node.js using the .msi installerNodeJS Node · node +1
- CVE-2023-30581The use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules outside of the policy.json definitionNodeJS Node
- CVE-2023-39331A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6NodeJS Node
- CVE-2023-38552When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy…NodeJS Node
- CVE-2023-39332Various node:fs functions allow specifying paths as either strings or Uint8Array objectsNodeJS Node
- CVE-2023-45143Undici's cookie header not cleared on cross-origin redirect in fetchnodejs undici · undici
- CVE-2023-32558The use of the deprecated API process.binding() can bypass the permission model through path traversalNodeJS Node · node +1
- CVE-2023-32005A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non- argumentNodeJS Node
- CVE-2023-32559A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.xNodeJS Node
- CVE-2023-32002The use of Module._load() can bypass the policy mechanism and require modules outside of the policy.json definition for a given moduleNodeJS Node
- CVE-2023-32003fs.mkdtemp() and fs.mkdtempSync() can be used to bypass the permission model check using a path traversal attackNodeJS Node
- CVE-2023-32004A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission modelNodeJS Node
- CVE-2023-32006The use of module.constructor.createRequire() can bypass the policy mechanism and require modules outside of the policy.json definition for a given moduleNodeJS Node
- CVE-2023-30586A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the…NodeJS Node
- CVE-2023-30589The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requestsNodeJS Node · node +2
- CVE-2023-26111All versions of the package @nubosoftware/node-static; all versions of the package node-static are vulnerable to Directory Traversal due to improper file path sanitization in the startsWith() method…@nubosoftware/node-static · node-static
- CVE-2023-23918A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html)…NodeJS Node
- CVE-2023-23919A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set itNodeJS Node
- CVE-2023-23920An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated…NodeJS Node
- CVE-2023-23936CRLF Injection in Nodejs ‘undici’ via hostnodejs undici · undici
- CVE-2023-24807Undici vulnerable to Regular Expression Denial of Service in Headersnodejs undici · undici
- CVE-2022-35255A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.ccNodeJS Node
- CVE-2022-35256The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRFNodeJS Node
- CVE-2022-43548A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does…NodeJS Node
- CVE-2022-24375Denial of Service (DoS)node-opcua
- CVE-2022-21208Denial of Service (DoS)node-opcua
- CVE-2022-25231Denial of Service (DoS)node-opcua
- CVE-2022-35948CRLF Injection in Nodejs ‘undici’ via Content-Typenodejs undici · undici
- CVE-2022-35949undici.request vulnerable to SSRF using absolute URL on pathnamenodejs undici · undici
- CVE-2022-31151Uncleared cookies on cross-host/cross-origin redirect in undicinodejs undici · undici
- CVE-2022-31150CRLF injection in request headersnodejs undici · undici
- CVE-2022-32223Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a…NodeJS Node
- CVE-2022-32212A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not…NodeJS Node
- CVE-2022-32213The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS)NodeJS Node · llhttp
- CVE-2022-32214The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requestsNodeJS Node · llhttp
- CVE-2022-32215The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headersNodeJS Node
- CVE-2022-32222A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a…NodeJS Node
- CVE-2022-23812Malicious Packagenode-ipc
- CVE-2021-44533Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctlyNodeJS Node · node +1
- CVE-2021-44532Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string formatNodeJS Node
- CVE-2021-44531Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediatesNodeJS Node
- CVE-2022-21824Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object…NodeJS Node
- CVE-2021-22959The parser in accepts requests with a space (SP) right after the header name before the colonNodeJS Node
- CVE-2021-22960The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requestsNodeJS Node
- CVE-2021-22930Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behaviorNodeJS Node
- CVE-2021-22931Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js…NodeJS Node
- CVE-2021-22939If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would…NodeJS Node
- CVE-2021-22940Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behaviorNodeJS Node
- CVE-2021-22921Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platformsNodeJS Node
- CVE-2021-22918Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCIINodeJS Node
- CVE-2021-22883Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are establishedNodeJS Node
- CVE-2021-22884Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”NodeJS Node
- CVE-2020-7785Command Injectionnode-ps
- CVE-2020-8265Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementationNodeJS Node
- CVE-2020-8287Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields)NodeJS Node
- CVE-2020-7789Command Injectionnode-notifier
- CVE-2020-8277A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the…NodeJS Node
- CVE-2020-7740Server-side Request Forgery (SSRF)node-pdf-generator
- CVE-2020-8201Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting usersNodeJS Node
- CVE-2020-8252The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is…NodeJS Node
- CVE-2020-8251Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connectionsNodeJS Node
- CVE-2020-7721Prototype Pollutionnode-oojs
- CVE-2019-15606Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisonsNodeJS Node
- CVE-2019-15604Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificateNodeJS Node
- CVE-2019-15605HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformedNodeJS Node
- CVE-2019-5739Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlierNode.js
- CVE-2019-5737In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection…Node.js
Get alerts for new Node.js CVEs
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/feed?tech=node
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/feed?tech=node in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/feed?tech=node&format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/feed?tech=node&format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
Frequently asked questions
What are the latest Node.js CVEs?
The newest are CVE-2026-126051 (Node.js remote denial of service in TLS handshakes); CVE-2026-123875 (Node.js denial of service in HTTP/2 file responses); CVE-2026-123874 (Node.js remote memory corruption in HTTP/2 file serving).
Are any Node.js CVEs being exploited?
None of the 174 newest Node.js vulnerabilities are on CISA's Known Exploited Vulnerabilities list.
How many critical Node.js CVEs are there?
11 of the 174 newest are rated critical (CVSS 9.0 or higher, or rated critical by their source when they have no score): CVE-2024-3566, CVE-2023-39332, CVE-2023-32002, CVE-2022-35255, CVE-2022-23812 and more.
How do I get alerts for new Node.js CVEs?
Subscribe to this page's RSS, Atom or JSON feed, or connect a coding agent to the cve.now MCP server. Each new entry appears within minutes of its source.
Is there an RSS feed of Node.js CVEs?
Yes: https://cve.now/feed?tech=node. Add format=atom or format=json for Atom or JSON Feed. It is free and needs no account or API key.
How do I get Node.js CVEs in Slack or by email?
In Slack, run /feed subscribe https://cve.now/feed?tech=node. For email, give the RSS URL to any RSS-to-email service.