16 results · Feed
-
High 7.4CVE-2026-106069 Public exploit
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP addre…
-
Low 3.3CVE-2026-106073 Public exploit
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permissi…
-
Medium 6.7CVE-2026-106072 Public exploit
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint whe…
-
Medium 4.8CVE-2026-106074 Public exploit
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, a…
-
High 7.4CVE-2026-105483 Public exploit
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a co…
-
Medium 6.5CVE-2026-105481 Public exploit
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the…
-
High 7.4CVE-2026-105482 Public exploit
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() …
-
Medium 4.1CVE-2026-56850 Public exploit
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) cl…
-
Low 2.8
A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` e…
-
High 7.1CVE-2025-55130 Public exploit
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions …
-
High 7.1
A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when usin…
-
Medium 5.9
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable w…
-
Medium 6.5
A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freei…
-
High 7.5
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unh…
-
Medium 5.9
A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCal…
-
Medium 5.8CVE-2026-21636 Public exploit
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `-…