Browse CVEs

HIGH 7.5 CVE-2026-22036 Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default max… Undici 6.23.0 / 7.18.2+ Fix from $1,9502026-01-14 MEDIUM 5.5 CVE-2025-23084 A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functi… Node.js 18.20.6 / 20.18.2+ Fix from $1,6002025-01-28 CRITICAL 9.8 CVE-2024-3566EPSS 7% A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess fu… Node.js 1.6.19.0 / 1.77.2+ Fix from $2,3002024-04-10 CRITICAL 9.8 CVE-2024-21896 The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be tr… Node.js 20.11.1 / 21.6.2+ Fix from $2,3002024-02-20 HIGH 8.8 CVE-2024-21891 Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined im… Node.js 20.11.1 / 21.6.2+ Fix from $1,9502024-02-20 HIGH 7.8 CVE-2024-21892 On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated… Node.js 18.19.1 / 20.11.1+ Fix from $1,9502024-02-20 HIGH 7.5 CVE-2024-22019 A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaus… Node.js 18.19.1 / 20.11.1+ Fix from $1,9502024-02-20 MEDIUM 6.5 CVE-2024-21890 The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For examp… Node.js 20.11.1 / 21.6.2+ Fix from $1,6002024-02-20 MEDIUM 6.5 CVE-2024-24750 Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected versions calling `fetch(url)` and not consuming the incoming body ((or co… Undici 6.6.1+ Fix from $1,6002024-02-16 HIGH 7.5 CVE-2023-30590 The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a pr… Node.js 16.20.1 / 18.16.1+ Fix from $1,9502023-11-28 MEDIUM 5.3 CVE-2023-30588 When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it sus… Node.js 16.20.1 / 18.16.1+ Fix from $1,6002023-11-28 HIGH 7.5 CVE-2023-30585 A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install Node.js usin… Node.js 16.20.1 / 18.16.1+ Fix from $1,9502023-11-28 HIGH 7.5 CVE-2023-30581 The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definit… Node.js 16.20.1 / 18.16.1+ Fix from $1,9502023-11-23 CRITICAL 9.8 CVE-2023-39332 Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the… Node.js 20.8.0+ Fix from $2,3002023-10-18 HIGH 7.5 CVE-2023-38552 When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return… Node.js after 20.8.0 Fix from $1,9502023-10-18 HIGH 7.5 CVE-2023-39331 A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises becau… Node.js 20.8.1+ Fix from $1,9502023-10-18 HIGH 7.5 CVE-2023-32558 The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all users usin… Node.js 20.5.1+ Fix from $1,9502023-09-12 MEDIUM 5.3 CVE-2023-32005 A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used… Node.js 20.5.1+ Fix from $1,6002023-09-12 HIGH 7.5 CVE-2023-32559 A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the de… Node.js after 20.5.0 Fix from $1,9502023-08-24 CRITICAL 9.8 CVE-2023-32002 The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulne… Node.js after 20.5.0 Fix from $2,3002023-08-21 HIGH 8.8 CVE-2023-32004 A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handl… Node.js after 20.5.0 Fix from $1,9502023-08-15 HIGH 8.8 CVE-2023-32006 The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given… Node.js after 20.5.0 Fix from $1,9502023-08-15 MEDIUM 5.3 CVE-2023-32003 `fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack. This flaw arises from a missing… Node.js after 20.5.0 Fix from $1,6002023-08-15 HIGH 7.5 CVE-2023-30586 A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is en… Node.js 20.3.1+ Fix from $1,9502023-07-01 HIGH 7.5 CVE-2023-30589 The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request … Node.js 16.20.1 / 18.16.1+ Fix from $1,9502023-07-01 HIGH 7.5 CVE-2023-23918 A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Perm… Node.js 14.21.3 / 16.19.1+ Fix from $1,9502023-02-23 HIGH 7.5 CVE-2023-23919 A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack a… Node.js 14.21.3 / 16.19.1+ Fix from $1,9502023-02-23 HIGH 7.5 CVE-2023-24807 Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expre… Undici 5.19.1+ Fix from $1,9502023-02-16 MEDIUM 5.4 CVE-2023-23936 Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP he… Node.js 5.19.1 / 16.19.1+ Fix from $1,6002023-02-16 CRITICAL 9.1 CVE-2022-35255 A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in sr… Node.js 1.0 / 16.17.1+ Fix from $2,3002022-12-05