Latest vulnerabilities for vendor "node.js" - SecAlerts

Where

Sort:

Recently updated

Recently published

-Infinity

0

Trending

Vendor Risk Score

See how node.js compares to other vendors in security performance

View Risk Score →

Software

node.js node.js

node.js node.js 22

node.js node.js 24

node.js node.js 26

node.js body-parser

node.js node-tar

node.js node.js runtime

node.js systeminformation

Node.js node-tarnode-tar: Decompression/parse DoS via unlimited input

Risk 49

Severity

9.2

First published (updated )

oss-secFwd: Node.js security updates for all active lease lines, June 2026

First published (updated )

https://seclists.org/oss-sec/2026/q3/12

Node.js Node.js 22A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to…

Risk 33

Severity

7

First published (updated )

REDHAT-BUG-2493337

Node.js nodejsA flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authorit…

Risk 19

Severity

4

First published (updated )

REDHAT-BUG-2493326

Nodejs Node.jsA flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before th…

Risk 21

Severity

3.7

First published (updated )

oss-secFwd: Node.js security updates for all active lease lines, June 2026

First published (updated )

https://seclists.org/oss-sec/2026/q2/984

Node.js Node.jsA flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path…

Risk 11

Severity

1.8

First published (updated )

oss-secFwd: Node.js security updates for all active lease lines, June 2026

First published (updated )

https://seclists.org/oss-sec/2026/q2/875

BleepingComputerCritical vm2 sandbox bug lets attackers execute code on hosts

First published (updated )

News

BleepingComputer

Node.js Node.jsA flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operat…

Risk 19

Severity

4

First published (updated )

REDHAT-BUG-2453158

Node.js Node.jsAn incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the pro…

Risk 5

Severity

1

First published (updated )

REDHAT-BUG-2453157

Node.js Node.jsA memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 …

Risk 19

Severity

4

First published (updated )

REDHAT-BUG-2453161

Node.js Node.jsA flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received wi…

Risk 33

Severity

7

First published (updated )

REDHAT-BUG-2453151

Node.js Node.jsA flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received wi…

Risk 46

Severity

7.5

First published (updated )

Node.js Node.jsA flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provide…

Risk 38

Severity

5.9

First published (updated )

Node.js Node.jsA flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric va…

Risk 38

Severity

5.9

First published (updated )

Node.js Node.jsA flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operat…

Risk 41

Severity

5.3

First published (updated )

Node.js Node.jsA flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without …

Risk 19

Severity

3.3

First published (updated )

oss-secNodeJS Security leases fixes High, 5 Medium, 2 Low severity issues

First published (updated )

https://seclists.org/oss-sec/2026/q1/379

node.js systeminformationCommand Injection

Risk 33

Severity

7

First published (updated )

REDHAT-BUG-2441121

Node.js Node.jsA memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to …

Risk 45

Severity

7.5

First published (updated )

Node.js node-staticThis affects all versions of the package node-static; all versions of the package @nubosoftware/node…

Risk 43

Severity

7.5

First published (updated )

Node.js messageformatThe Runtime components of messageformat package for Node.js before 3.0.2 contain a prototype polluti…

Risk 27

Severity

5.3

First published (updated )

npm/express-xss-sanitizerXSS

Risk 27

Severity

5.3

First published (updated )

Node.js Node.jsPath Traversal

Risk 45

Severity

7.5

First published (updated )

Node.js Node.jsThe V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. T…

Risk 45

Severity

7.5

First published (updated )

BleepingComputerNorth Korean XORIndex malware hidden in 67 malicious npm packages

First published (updated )

News

BleepingComputer

BleepingComputerInterlock ransomware adopts new FileFix attack to push malware

First published (updated )

News

BleepingComputer

Fwd: Node.js security updates for all active lease lines, May 2025

First published (updated )

https://seclists.org/oss-sec/2025/q3/15

Node.js pbkdf2On Node.js < 3, pbkdf2 silently disregards Uint8Array input, returning static keys

Risk 55

Severity

9.1

EPSS

0.10%

First published (updated )

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203