Linux 13140
Google 12525
Microsoft 12378
Apple 6692
Oracle 6649
Adobe 6383
Ibm 6266
Cisco 5746
Debian 3919
Apache 2864
Mozilla 2857
Redhat 2581
Undici
HIGH 7.5
Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default max…
Node.js
MEDIUM 5.5
A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functi…
Node.js
CRITICAL 9.8
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess fu…
Node.js
CRITICAL 9.8
The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be tr…
Node.js
HIGH 8.8
Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined im…
Node.js
HIGH 7.8
On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated…
Node.js
HIGH 7.5
A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaus…
Node.js
MEDIUM 6.5
The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For examp…
Undici
MEDIUM 6.5
Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected versions calling `fetch(url)` and not consuming the incoming body ((or co…
Node.js
HIGH 7.5
The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a pr…
Node.js
MEDIUM 5.3
When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it sus…
Node.js
HIGH 7.5
A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install Node.js usin…
Node.js
HIGH 7.5
The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definit…
Node.js
CRITICAL 9.8
Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the…
Node.js
HIGH 7.5
When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return…
Node.js
HIGH 7.5
A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises becau…
Node.js
HIGH 7.5
The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all users usin…
Node.js
MEDIUM 5.3
A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used…
Node.js
HIGH 7.5
A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the de…
Node.js
CRITICAL 9.8
The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulne…
Node.js
HIGH 8.8
A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handl…
Node.js
HIGH 8.8
The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given…
Node.js
MEDIUM 5.3
`fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack. This flaw arises from a missing…
Node.js
HIGH 7.5
A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is en…
Node.js
HIGH 7.5
The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request …
Node.js
HIGH 7.5
A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Perm…
Node.js
HIGH 7.5
A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack a…
Undici
HIGH 7.5
Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expre…
Node.js
MEDIUM 5.4
Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP he…
Node.js
CRITICAL 9.1
A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in sr…