Skip to content
OpenAdvisories

Package · Debian

nodejs

126 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 9.2
    CVE-2026-111497 Exploited Public exploit EPSS 83%

    Out-of-Bounds Write in Google Brotli Decoder

    A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …

    Google Brotli nodejs dotnet7 Debian Ubuntu Alpine PyPI Go Hex
    KEV Oct 27, 2026
  • Critical 9.8
    CVE-2023-32002

    The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition f…

    nodejs node nodejs nodejs Debian Ubuntu Alpine
  • Critical 9.1
    CVE-2022-35255

    A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in Secret…

    nodejs node nodejs nodejs Debian Alpine
  • Critical 9.1
    CVE-2022-32214 EPSS 82%

    llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields

    The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

    nodejs node nodejs nodejs Debian Ubuntu Alpine npm
  • Critical 9.1
    CVE-2022-32213 EPSS 45%

    llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding

    The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).

    nodejs node nodejs nodejs Debian Ubuntu Alpine npm