18 results · Clear filters · Feed
-
Low 3.3
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permissi…
-
Low 3.6
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--all…
-
Low 3.7
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after t…
-
Low 3.7
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild o…
-
Low 3.7
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild o…
-
Low 3.3
A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-w…
-
Low 3.3
A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside…
-
Low 3.3
A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with…
-
Low 3.3
A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `-…
-
Low 3.7
A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent t…
-
Low 1.8
A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. Thi…
-
Low 3.3
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read p…
-
Low 3.3
An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without t…
-
Low 2.8
A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` e…
-
Low 3.7
In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 pat…
-
Low 3.6
The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be igno…
-
Low 3.3
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-f…
-
Low 2.9
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-f…