8 results · Clear filters · Feed
-
High 7.4CVE-2026-106069 Public exploit
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP addre…
-
High 7.4CVE-2026-105483 Public exploit
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a co…
-
High 7.4CVE-2026-105482 Public exploit
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() …
-
High 7.5CVE-2026-56848 Public exploit
A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_…
-
High 7.5CVE-2026-58043 Public exploit
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Un…
-
High 7.1CVE-2025-55130 Public exploit
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions …
-
High 7.1
A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when usin…
-
High 7.5
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unh…