Node.js
258 CVEs tracked. 1 of them are in CISA KEV.
This hub aggregates every CVE we track for Node.js, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Node.js CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 1 |
| 2024-12 | 0 |
| 2025-01 | 4 |
| 2025-02 | 1 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 5 |
| 2025-06 | 2 |
| 2025-07 | 2 |
| 2025-08 | 1 |
| 2025-09 | 1 |
| 2025-10 | 1 |
| 2025-11 | 1 |
| 2025-12 | 0 |
| 2026-01 | 16 |
| 2026-02 | 1 |
| 2026-03 | 8 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 12 |
| 2026-07 | 3 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 258 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical23
- High132
- Medium87
- Low16
Latest CVEs
The 15 most recently published vulnerabilities affecting Node.js.
- CVE-2026-56850A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client ...4.4
- CVE-2026-56847A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality impact or bypass of t...6.1
- CVE-2026-58043A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse...8.4
- CVE-2026-48930A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all su...9.8
- CVE-2026-48935A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`. This vulnerability affects all supported release l...3.3
- CVE-2026-48928A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**,...5.4
- CVE-2026-48615A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the proxy URL, they may be exposed throu...7.5
- CVE-2026-48933A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all supported release lines: **Node.js 22**,...7.5
- CVE-2026-48936A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission. This vulnerability affects one supported release li...3.3
- CVE-2026-48619A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client. This vulnerability affects all supported r...7.5
- CVE-2026-48618A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mis...6.5
- CVE-2026-48934A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **No...4.3
- CVE-2026-48931A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects all supported release lines: **Node....3.7
- CVE-2026-48937A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supported release lines: **Node.js 22** and **Node.j...7.5
- CVE-2026-48617A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security bounda...8.2
Product grouping is registry-driven, with AI assist and human review. How it works