13 results · Feed
-
Medium 5.9
A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, poten…
-
Low 3.3
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read p…
-
Medium 5.3
A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) …
-
Medium 5.9CVE-2026-21717 Public exploit
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash co…
-
High 7.5
A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `…
-
Low 3.3
An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without t…
-
Low 2.8
A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` e…
-
High 7.1CVE-2025-55130 Public exploit
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions …
-
High 7.1
A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when usin…
-
Medium 5.9
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable w…
-
High 7.5
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unh…
-
Medium 5.9
A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCal…
-
High 7.7
With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This …