Browse CVEs

HIGH 8.1 CVE-2022-43548EPSS 14% A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that… Node.js 14.21.1 / 16.18.1+ Fix from $1,9502022-12-05 MEDIUM 6.5 CVE-2022-35256 The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HT… Node.js 1.0 / 6.0.10+ Fix from $1,6002022-12-05 MEDIUM 5.3 CVE-2022-35948 undici is an HTTP/1.1 client, written from scratch for Node.js.`=< [email protected]` users are vulnerable to _CRLF Injection_ on headers when using unsan… Undici 5.8.2+ Fix from $1,6002022-08-15 CRITICAL 9.8 CVE-2022-35949 undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes… Undici after 5.8.1 Fix from $2,3002022-08-12 MEDIUM 6.5 CVE-2022-31151 Authorization headers are cleared on cross-origin redirect. However, cookie headers which are sensitive headers and are official headers found in the… Undici 5.7.1+ Fix from $1,6002022-07-21 MEDIUM 6.5 CVE-2022-31150 undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions le… Undici 5.8.0+ Fix from $1,6002022-07-19 HIGH 8.1 CVE-2022-32212EPSS 6% A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easil… Node.js 1.0 / 14.20.1+ Fix from $1,9502022-07-14 HIGH 7.3 CVE-2022-32223 Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if th… Node.js 14.20.0 / 16.16.0+ Fix from $1,9502022-07-14 MEDIUM 6.5 CVE-2022-32210 `Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly me… Undici 5.5.1+ Fix from $1,6002022-07-14 MEDIUM 6.5 CVE-2022-32213EPSS 42% The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and… Node.js 2.1.5 / 3.3.2+ Fix from $1,6002022-07-14 MEDIUM 6.5 CVE-2022-32214EPSS 81% The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. T… Node.js 2.1.5 / 3.3.0+ Fix from $1,6002022-07-14 MEDIUM 6.5 CVE-2022-32215EPSS 69% The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. Thi… Node.js 3.3.2 / 14.20.0+ Fix from $1,6002022-07-14 MEDIUM 5.3 CVE-2022-32222 A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might… Node.js 1.0 / 18.5.0+ Fix from $1,6002022-07-14 HIGH 8.2 CVE-2022-21824EPSS 22% Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" paramet… Node.js 12.22.9 / 14.18.3+ Fix from $1,9502022-02-24 HIGH 7.4 CVE-2021-44531EPSS 8% Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing … Node.js 12.22.9 / 14.18.3+ Fix from $1,9502022-02-24 MEDIUM 5.3 CVE-2021-44532EPSS 10% Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer… Node.js 12.22.9 / 14.18.3+ Fix from $1,6002022-02-24 MEDIUM 5.3 CVE-2021-44533EPSS 9% Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certif… Node.js 8.0.29 / 12.22.9+ Fix from $1,6002022-02-24 CRITICAL 9.8 CVE-2021-22930EPSS 36% Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption… Node.js 1.0.1.1 / 12.22.4+ Fix from $2,3002021-10-07 CRITICAL 9.8 CVE-2021-22931EPSS 22% Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host … Node.js 12.22.5 / 14.17.5+ Fix from $2,3002021-08-16 HIGH 7.5 CVE-2021-22940EPSS 14% Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption… Node.js 1.0.1.1 / 12.22.5+ Fix from $1,9502021-08-16 MEDIUM 5.3 CVE-2021-22939EPSS 15% If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connect… Node.js 1.0.1.1 / 12.22.5+ Fix from $1,6002021-08-16 HIGH 7.8 CVE-2021-22921EPSS 7% Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More s… Node.js 1.0.1.1 / 12.22.2+ Fix from $1,9502021-07-12 MEDIUM 5.3 CVE-2021-22918EPSS 23% Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The point… Node.js 1.0.1.1 / 12.22.2+ Fix from $1,6002021-07-12 HIGH 7.5 CVE-2021-22883EPSS 74% Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownP… Node.js 9.2.6.0 / 10.24.0+ Fix from $1,9502021-03-03 HIGH 7.5 CVE-2021-22884EPSS 32% Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6… Node.js 10.24.0 / 12.21.0+ Fix from $1,9502021-03-03 HIGH 8.1 CVE-2020-8265EPSS 9% Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS ena… Node.js 1.0.1.1 / 10.23.1+ Fix from $1,9502021-01-06 MEDIUM 6.5 CVE-2020-8287EPSS 16% Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding h… Node.js 1.0.1.1 / 10.23.1+ Fix from $1,6002021-01-06 HIGH 7.5 CVE-2020-8277EPSS 54% A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.… Node.js 1.16.0 / 9.2.6.0+ Fix from $1,9502020-11-19 HIGH 7.8 CVE-2020-8252 The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can resul… Node.js 10.22.1 / 12.18.4+ Fix from $1,9502020-09-18 HIGH 7.5 CVE-2020-8251EPSS 9% Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to acce… Node.js 14.11.0+ Fix from $1,9502020-09-18