47 results · Clear filters · Feed
-
High 7.4CVE-2026-106069 Public exploit
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP addre…
-
Low 3.3CVE-2026-106073 Public exploit
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permissi…
-
Low 3.6CVE-2026-106071 Public exploit
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--all…
-
Low 3.7CVE-2026-106070 Public exploit
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after t…
-
Medium 6.7CVE-2026-106072 Public exploit
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint whe…
-
Medium 4.8CVE-2026-106074 Public exploit
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, a…
-
High 7.4CVE-2026-105483 Public exploit
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a co…
-
Medium 6.5CVE-2026-105481 Public exploit
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the…
-
High 7.4CVE-2026-105482 Public exploit
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() …
-
Critical 9.2
Out-of-Bounds Write in Google Brotli Decoder
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …
KEV Oct 27, 2026 -
High 7.5CVE-2026-63072 Public exploit
Heap Buffer Overflow in CMS Key Unwrapping
Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impa…
-
High 7.5CVE-2026-56848 Public exploit
A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_…
-
Medium 5.3CVE-2026-58041 Public exploit
A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to con…
-
Medium 6.2CVE-2026-58045 Public exploit
A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:…
-
Medium 5.9CVE-2026-58042 Public exploit
A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Re…
-
Low 3.7CVE-2026-58044 Public exploit
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild o…
-
High 7.5CVE-2026-56846 Public exploit
A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memo…
-
Low 3.3CVE-2026-58039 Public exploit
A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-w…
-
High 7.5CVE-2026-58043 Public exploit
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Un…
-
Medium 4.1CVE-2026-56850 Public exploit
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) cl…
-
Low 3.3CVE-2026-56847 Public exploit
A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside…
-
Medium 6.3CVE-2026-58040 Public exploit
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across iden…
-
High 8.8CVE-2026-45447 Public exploit
Heap Use-After-Free in the PKCS7_verify() Function
Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When…
-
Medium 5.9CVE-2026-21717 Public exploit
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash co…
-
High 7.5
A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `…
-
High 7.5CVE-2025-69421 Public exploit
NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function. Impact summary: A NULL pointer dereference can trigger a crash which leads to Denial of Service for an application processi…
-
High 7.5CVE-2025-69420 Public exploit
Missing ASN1_TYPE validation in TS_RESP_verify_response() function
Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing a malformed TimeStam…
-
High 7.4CVE-2025-69419 Public exploit
Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion
Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the allocated buffer. Impact summary: The out-of-…
-
High 8.8
Stack buffer overflow in CMS (Auth)EnvelopedData parsing
Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote c…
-
Medium 6.1CVE-2025-11187 Public exploit
Improper validation of PBMAC1 parameters in PKCS#12 MAC verification
Issue summary: PBMAC1 parameters in PKCS#12 files are missing validation which can trigger a stack-based buffer overflow, invalid pointer or NULL pointer dereference during MAC verification. Impact summary: The stack buffer overflow or NULL pointer dereferenc…
-
High 7.1CVE-2025-55130 Public exploit
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions …
-
Medium 5.8CVE-2026-21636 Public exploit
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `-…
-
Medium 4.6CVE-2024-13176 Public exploit
Timing side-channel in ECDSA signature computation
Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacke…
-
Critical 9.1CVE-2024-5535 Public exploit
SSL_select_next_proto buffer overread
Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences suc…
-
High 8.2
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packet…
-
High 7.5
HTTP/2 Stream Cancellation Attack
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
KEV Oct 10, 2023 -
High 7.5CVE-2023-0464 Public exploit
Excessive Resource Usage Verifying X.509 Policy Constraints
A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate …
-
Medium 5.9
Timing Oracle in RSA Decryption
A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a …
-
High 7.5CVE-2022-2097 Public exploit
AES OCB fails to encrypt some bytes
AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the…
-
Critical 9.8
The c_rehash script allows command injection
The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitra…