NodeJS vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-106069 A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, High 7.4 · Oct 23, 2026
• CVE-2026-105483 A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the hostHigh 7.4 · Oct 23, 2026
• CVE-2026-105482 A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse().High 7.4 · Oct 23, 2026
• CVE-2026-56848 A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a High 7.5 · Aug 4, 2026
• CVE-2026-56846 A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion.High 7.5 · Aug 3, 2026
• CVE-2026-58043 A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.High 8.4 · Jul 30, 2026
• CVE-2026-48933 A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB.High 7.5 · Jun 25, 2026
• CVE-2026-48930 A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings.Critical 9.8 · Jun 25, 2026
• CVE-2026-48619 A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client.High 7.5 · Jun 25, 2026
• CVE-2026-48615 A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages.High 7.5 · Jun 25, 2026
• CVE-2026-48937 A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame.High 7.5 · Jun 18, 2026
• CVE-2026-48617 A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation.High 8.2 · Jun 18, 2026
• CVE-2026-21710 A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `High 7.5 · Mar 30, 2026
• CVE-2026-21637 A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use.High 7.5 · Jan 20, 2026
• CVE-2026-21636 A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled.Critical 10 · Jan 20, 2026
• CVE-2025-59466 We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabledHigh 7.5 · Jan 20, 2026
• CVE-2025-59465 A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`.High 7.5 · Jan 20, 2026
• CVE-2025-59464 A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer.High 7.5 · Jan 20, 2026
• CVE-2025-55131 A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout optionHigh 7.1 · Jan 20, 2026
• CVE-2025-55130 A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths.Critical 9.1 · Jan 20, 2026
• CVE-2025-27210 An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX.High 7.5 · Jul 18, 2025
• CVE-2025-27209 The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash.High 7.5 · Jul 18, 2025
• CVE-2025-23166 The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the High 7.5 · May 18, 2025
• CVE-2025-23083 With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created.High 7.7 · Jan 21, 2025
• CVE-2024-27980 Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands anHigh 8.1 · Jan 8, 2025