36 results · Clear filters · Feed
-
Medium 6.7
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint whe…
-
Medium 4.8
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, a…
-
Medium 6.5
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the…
-
Medium 5.3
A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to con…
-
Medium 6.2
A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:…
-
Medium 5.9
A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Re…
-
Medium 4.1
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) cl…
-
Medium 6.3
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across iden…
-
Medium 5.6
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to …
-
Medium 4.3
A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability af…
-
Medium 5.3
A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Ou…
-
Medium 4.2
A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnera…
-
Medium 5.9
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When…
-
Medium 5.3
A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This …
-
Medium 5.9
A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, poten…
-
Medium 5.3
A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) …
-
Medium 5.3
A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the re…
-
Medium 5.9
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash co…
-
Medium 5.7
A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malfor…
-
Medium 5.9
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable w…
-
Medium 6.5
A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freei…
-
Medium 5.9
A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCal…
-
Medium 5.8
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `-…
-
Medium 6.5
A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the require…
-
Medium 5.3
A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Addition…
-
Medium 5.6
A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows envir…
-
Medium 5.3
Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be…
-
Medium 5.3
A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when th…
-
Medium 6.5
A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URL…
-
Medium 6.5
The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed…
-
Medium 6.5
A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhausti…
-
Medium 5.0
The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last chara…
-
Medium 5.3
A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when th…
-
Medium 5.3
`fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack. T…
-
Medium 4.2
An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an…
-
Medium 6.5
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated wi…