Skip to content
OpenAdvisories

Product · nodejs

node

129 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.8
    CVE-2023-32002

    The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition f…

    nodejs node nodejs nodejs Debian Ubuntu Alpine
  • Critical 9.1
    CVE-2022-35255

    A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in Secret…

    nodejs node nodejs nodejs Debian Alpine
  • Critical 9.1
    CVE-2022-32214 EPSS 82%

    llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields

    The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

    nodejs node nodejs nodejs Debian Ubuntu Alpine npm
  • Critical 9.1
    CVE-2022-32213 EPSS 45%

    llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding

    The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).

    nodejs node nodejs nodejs Debian Ubuntu Alpine npm