Nodejs Node vulnerabilities

CVE-2024-22025 [MEDIUM] CWE-404 CVE-2024-22025: A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack throug A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetch() function to retrieve content from an untrusted URL. The vulnerability stems from the fact that the fetch() function in Node.js always decodes Brotli, making it possible for an attacker to cause resource exh

CVE-2026-21717 [MEDIUM] CWE-328 CVE-2026-21717: A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric va A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process. The most common trigger is any endpoint

CVE-2026-21712 [MEDIUM] CWE-20 CVE-2026-21712: A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is c A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.

CVE-2026-56847 [MEDIUM] CWE-1119 CVE-2026-56847: A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.

CVE-2022-32222 [MEDIUM] CWE-310 CVE-2022-32222: A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3.

CVE-2023-32003 [MEDIUM] CWE-22 CVE-2023-32003: `fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path `fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack. This flaw arises from a missing check in the fs.mkdtemp() API and the impact is a malicious actor could create an arbitrary directory. This vulnerability affects all users using the experimental permission model in Node.js 20. Please

CVE-2026-58042 [MEDIUM] CWE-400 CVE-2026-58042: A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to denial of service. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

CVE-2023-39333 [MEDIUM] CWE-94 CVE-2023-39333: Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The i Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module. This vulnerability affects users of any active release line of Node.js.

CVE-2026-21714 [MEDIUM] CWE-401 CVE-2026-21714: A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up. This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25

CVE-2025-55132 [MEDIUM] CWE-276 CVE-2025-55132: A flaw in Node.js's permission model allows a file's access and modification timestamps to be change A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to a

CVE-2025-23084 [MEDIUM] CWE-22 CVE-2025-23084: A vulnerability has been identified in Node.js, specifically affecting the handling of drive names i A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory. On Windows, a path that does not start with the file

CVE-2023-32005 [MEDIUM] CWE-732 CVE-2023-32005: A vulnerability has been identified in Node.js version 20, affecting users of the experimental permi A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument. This flaw arises from an inadequate permission model that fails to restrict file stats through the `fs.statfs` API. As a result, malicious actors can retrieve stats from files t

CVE-2023-30588 [MEDIUM] CVE-2023-30588: When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current contex

CVE-2026-58041 [MEDIUM] CWE-367 CVE-2026-58041: A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#crea A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for S

CVE-2026-21711 [MEDIUM] CWE-284 CVE-2026-21711: A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operat A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other

CVE-2023-30582 [MEDIUM] CWE-284 CVE-2023-30582: A vulnerability has been identified in Node.js version 20, affecting users of the experimental permi A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument. This flaw arises from an inadequate permission model that fails to restrict file watching through the fs.watchFile API. As a result, malicious actors can monitor files that they

CVE-2026-48928 [MEDIUM] CWE-284 CVE-2026-48928: A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS s A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

CVE-2025-23085 [MEDIUM] CWE-401 CVE-2025-23085: A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY not A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain

CVE-2026-58045 [MEDIUM] CWE-400 CVE-2026-58045: A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This vulnerability affects Node.js **22.x**, **24.x**, and

CVE-2026-48934 [MEDIUM] CWE-295 CVE-2026-48934: A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.