Summary
Ein Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Daten zu manipulieren und um Sicherheitsvorkehrungen zu umgehen.
Product
Node.js ist eine Plattform zur Entwicklung von Netzwerkanwendungen.
Vulnerabilities 16
-
High 8.2
A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TL…
-
High 8.1
A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, includin…
-
High 8.1
A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiat…
-
High 7.5
An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a peer triggers a …
-
High 7.5
A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connection…
-
High 7.5
A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, w…
-
High 7.5
A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacke…
-
Medium 6.8
A certificate validation bypass in Node.js https.Agent lets a cached TLS session authenticated under one CA policy be r…
-
Medium 6.2
Node.js discloses proxy credentials in ERR_PROXY_INVALID_CONFIG error messages. CVE-2026-48615 established that a proxy…
-
Medium 5.9
A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling lets a remote, unauthenticated attacker corrupt proc…
-
Medium 5.9
An unauthenticated HTTP/2 client can exhaust Node.js server memory because inbound DATA queued on an undrained stream i…
-
Medium 5.9
A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and clearte…
-
Medium 4.2
Node.js is vulnerable to a per-host mTLS authorization bypass via a CA-only SNI context failing open to the default CA
A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different client-certificate CA with `server.addContext(host, {…
-
Low 3.6CVE-2026-106071 Public exploit
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--all…
-
Low 2.9
An uncatchable exception in the Node.js zlib streaming API lets a peer crash a process by disconnecting while data is b…
-
Low 2.5
A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process i…
Revision history
-
#1
Initiale Fassung
References
-
Node.js November 2026 Security Releases vom 2026-11-11
https://nodejs.org/en/blog/vulnerability/november-2026-security-releases