14 results · Clear filters · Feed
-
Medium 5.3
A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This …
-
Medium 5.9
A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, poten…
-
Medium 5.3
A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) …
-
Medium 5.9CVE-2026-21717 Public exploit
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash co…
-
Medium 5.9
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable w…
-
Medium 5.9
A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCal…
-
Medium 6.5CVE-2025-23167 Public exploit
A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the require…
-
Medium 5.3
A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Addition…
-
Medium 5.6
A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows envir…
-
Medium 5.3
Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be…
-
Medium 6.5
A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URL…
-
Medium 6.5
The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed…
-
Medium 6.5
A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhausti…
-
Medium 5.0
The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last chara…