Nodejs Node vulnerabilities

CVE-2026-48928 [MEDIUM] CWE-284 CVE-2026-48928: A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS s A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

CVE-2025-23085 [MEDIUM] CWE-401 CVE-2025-23085: A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY not A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain

CVE-2026-106074 [MEDIUM] CWE-330 CVE-2026-106074: A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`. If any of these functions, or an API that relies on them such as `URL.createOb

CVE-2026-58045 [MEDIUM] CWE-400 CVE-2026-58045: A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This vulnerability affects Node.js **22.x**, **24.x**, and

CVE-2026-48934 [MEDIUM] CWE-295 CVE-2026-48934: A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

CVE-2026-56850 [MEDIUM] CWE-287 CVE-2026-56850: A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing m A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

CVE-2023-23920 [MEDIUM] CWE-426 CVE-2023-23920: An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.

CVE-2026-48932 [LOW] CWE-444 CVE-2026-48932: A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding pro A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection. Node.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `

CVE-2026-58044 [LOW] CWE-444 CVE-2026-58044: A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding pro A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection. Node.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `

CVE-2026-106070 [LOW] CWE-840 CVE-2026-106070: A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requ A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When `zipEntry.modified` is read on an archive whose local header does not match its central directory, either directly or while compacting the archive, the validation error is caught bu

CVE-2026-48931 [LOW] CWE-367 CVE-2026-48931: A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before th A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

CVE-2026-106071 [LOW] CWE-284 CVE-2026-106071: A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not matc A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*`

CVE-2026-106073 [LOW] CWE-284 CVE-2026-106073: A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the req A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync()` to check file

CVE-2025-23165 [LOW] CWE-401 CVE-2025-23165: In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s. In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service. Impact: *

CVE-2024-37372 [LOW] CWE-22 CVE-2024-37372: The Permission Model assumes that any path starting with two backslashes \ has a four-character pref The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.

CVE-2026-48935 [LOW] CWE-276 CVE-2026-48935: A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was se A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

CVE-2026-21715 [LOW] CWE-732 CVE-2026-21715: A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, reso

CVE-2026-58039 [LOW] CWE-284 CVE-2026-58039: A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files o A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.

CVE-2024-36137 [LOW] CVE-2024-36137: A vulnerability has been identified in Node.js, affecting users of the experimental permission model A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file.

CVE-2026-48936 [LOW] CWE-284 CVE-2026-48936: A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission. This vulnerability affects one supported release line: **Node.js 26**.