Skip to content
OpenAdvisories

Vendor

NodeBB

14 known vulnerabilities.

Products

NodeBB 13 NodeBB Plugin Emoji 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.5
    CVE-2026-58593

    NodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to Local User

    NodeBB does not bind the claimed author of an inbound ActivityPub object to the authenticated remote actor. The inbound middleware verifies the HTTP-signature actor and checks the origin of object.id, but never validates that attributedTo corresponds to the s…

    NodeBB NodeBB
  • High 7.5
    CVE-2021-47746

    NodeBB Plugin Emoji 3.2.1 - Arbitrary File Write

    NodeBB Plugin Emoji 3.2.1 contains an arbitrary file write vulnerability that allows administrative users to write files to arbitrary system locations through the emoji upload API. Attackers with admin access can craft file upload requests with directory trav…

    NodeBB NodeBB Plugin Emoji
  • High 7.5
    CVE-2023-30591 EPSS 59%

    NodeBB Pre-Authentication Denial-of-Service

    Denial-of-service in NodeBB <= v2.8.10 allows unauthenticated attackers to trigger a crash, when invoking `eventName.startsWith()` or `eventName.toString()`, while processing Socket.IO messages via crafted Socket.IO messages containing array or object type fo…

    NodeBB NodeBB
  • High 8.8
    CVE-2022-36076

    Account takeover via SSO plugins in NodeBB

    NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. Due to an unnecessarily strict conditional in the code handling the first step of the SSO process, the pre-existing logic that added (and later checked) …

    NodeBB NodeBB nodebb npm