Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how nodejs compares to other vendors in security performance

View Risk Score →

Nodejs Node.jsA flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authorit…

Risk 90
Severity
9.8
First published (updated )
CVE-2026-48930

Node.jsInteger Overflow

Risk 46
Severity
7.5
First published (updated )
CVE-2026-48933

Nodejs Node.jsA inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS s…

Risk 36
Severity
5.4
First published (updated )
CVE-2026-48928

Nodejs Node.jsA flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which …

Risk 46
Severity
7.5
First published (updated )
CVE-2026-48619

Nodejs Node.jsA flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. T…

Risk 24
Severity
4.3
First published (updated )
CVE-2026-48934
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

npm/nodeA flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), …

Risk 18
Severity
3.3
First published (updated )
CVE-2026-48936

Nodejs Node.jsA flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was se…

Risk 19
Severity
3.3
First published (updated )
CVE-2026-48935

nodejsA flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` e…

Risk 46
Severity
7.5
First published (updated )
CVE-2026-48615

Nodejs Node.jsA flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to…

Risk 46
Severity
7.7
First published (updated )
CVE-2026-48618

Nodejs Node.jsA flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before th…

Risk 21
Severity
3.7
First published (updated )
CVE-2026-48931
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

npm/undiciundici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

Risk 20
Severity
3.7
First published (updated )
CVE-2026-11525

npm/undiciundici vulnerable to HTTP response queue poisoning via keep-alive socket reuse

Risk 20
Severity
3.7
First published (updated )
CVE-2026-6733

npm/undiciundici vulnerable to cross-user information disclosure via shared cache whitespace bypass

Risk 26
Severity
5.9
EPSS
0.36%
First published (updated )
CVE-2026-9678

npm/undiciundici vulnerable to HTTP header injection via Set-Cookie percent-decoding

Risk 26
Severity
5.9
EPSS
0.26%
First published (updated )
CVE-2026-9679

npm/undiciundici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

Risk 41
Severity
7.4
EPSS
0.46%
First published (updated )
CVE-2026-9697
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

npm/undiciundici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

Risk 79
Severity
8.8
First published (updated )
CVE-2026-6734

npm/undiciundici WebSocket client vulnerable to denial of service via cumulative fragment bypass

Risk 31
Severity
7.5
EPSS
0.43%
First published (updated )
CVE-2026-9675

npm/undiciundici WebSocket client vulnerable to denial of service via fragment count bypass

Risk 43
Severity
7.5
First published (updated )
CVE-2026-12151

npm/undiciundici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation

Risk 43
Severity
7.5
First published (updated )
CVE-2026-2229

npm/undiciundici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client

Risk 43
Severity
7.5
First published (updated )
CVE-2026-1528
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

npm/undiciundici is vulnerable to CRLF Injection via upgrade option

Risk 30
Severity
4.6
First published (updated )
CVE-2026-1527

npm/undiciundici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoS

Risk 35
Severity
5.9
First published (updated )
CVE-2026-2581

npm/undiciundici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression

Risk 43
Severity
7.5
First published (updated )
CVE-2026-1526

npm/undiciundici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Risk 86
Severity
9.8
First published (updated )
CVE-2026-1525

npm/nodeA flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network r…

Risk 63
Severity
10
EPSS
0.02%
First published (updated )
CVE-2026-21636
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Nodejs Node.jsHackerOne: CVE-2026-21637 TLS PSK/ALPN Callback Exceptions Bypass Error Handlers

Risk 32
Severity
7.5
EPSS
0.03%
First published (updated )
CVE-2026-21637

Nodejs Node.jsWe have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors b…

Risk 46
Severity
7.5
First published (updated )
CVE-2025-59466

Node.js Node.jsA memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to …

Risk 45
Severity
7.5
First published (updated )
CVE-2025-59464

Nodejs Node.jsA flaw in Node.js's permission model allows a file's access and modification timestamps to be change…

Risk 28
Severity
5.3
First published (updated )
CVE-2025-55132

npm/undiciUndici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion

Risk 31
Severity
7.5
EPSS
0.02%
First published (updated )
CVE-2026-22036
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203