nodejs node vulnerabilities, newest first, page 2
Filter
By year: all 2026 2025 2024 2023 2022 2021
- 5.3CVE-2023-30582EPSS 0.6%
A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument. This flaw arises from an inadequate permission model that fails to…
- 2.9CVE-2024-22018EPSS 0.5%
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the …
- 6.5CVE-2024-22020EPSS 1.1%
A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerabili…
- 6.5CVE-2024-27982EPSS 1.2%
The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is no…
- 8.2CVE-2024-27983EPSS 84%
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTT…
- 6.5CVE-2024-22025EPSS 1.3%
A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetch() function to retrieve content from an untrusted URL. The vulnerability stems from the fact that…
- 7.3CVE-2024-22017EPSS 0.9%
setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid()…