9 results · Clear filters · Feed
-
High 7.4CVE-2026-106069 Public exploit
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP addre…
-
High 7.4CVE-2026-105482 Public exploit
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() …
-
High 7.5CVE-2026-58043 Public exploit
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Un…
-
High 7.5
A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `…
-
High 7.1CVE-2025-55130 Public exploit
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions …
-
High 7.1
A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when usin…
-
High 7.5
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unh…
-
High 7.7
With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This …
-
High 7.5
Quadratic complexity parsing cookies with backslashes
There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic compl…