nodejs: Node.js: Certification validation bypass in TLS host verification

A flaw was found in Node.js. An attacker can exploit a vulnerability in the Transport Layer Security TLS host verification process to bypass certification validation. This bypass could allow an attacker to intercept or alter communications, potentially leading to information disclosure or integri...

nodejs: Node.js HTTP/2 Server: Denial of Service due to continued data acceptance after GOAWAY frame

A flaw in the Node.js HTTP/2 API allows remote attackers to cause a Denial of Service DoS by sending data after a GOAWAY frame, exhausting server resources...

nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames

A flaw was found in Node.js. A malicious server can exploit the HTTP/2 client by sending an unlimited number of ORIGIN frames. This can lead to an Out of Memory error on the client, resulting in a denial of service...

Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency

A flaw was found in Node.js. An inconsistency in how Node.js matches hostnames can be exploited by a remote attacker in multi-context mTLS mutual Transport Layer Security setups. This vulnerability allows for a trust-policy bypass, potentially leading to unauthorized access to sensitive informati...

nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling

A flaw was found in Node.js. This vulnerability in the TLS Transport Layer Security hostname handling allows embedded null characters in hostnames. This can lead to silent authority rebinding, potentially enabling an attacker to redirect network traffic to an unintended server and disclose...

nodejs: Node.js: Unauthorized file metadata modification

A flaw was found in Node.js. The Permission API allows a local user to modify file metadata on paths that have been explicitly set as read-only. This can lead to unauthorized changes in file properties, impacting the integrity of the file system...

send v4.1.1

@fastify/send Send is a library for streaming files from the file system as an HTTP response supporting partial responses Ranges, conditional-GET negotiation If-Match, If-Unmodified-Since, If-None-Match, If-Modified-Since, high test coverage, and granular events which may be leveraged to take...

CVE-2026-69116: Improper Neutralization of Input During Web Page Generation

FlyEnv before 4.18.0 fails to sanitize HTML from markdown rendering and AI chat content passed to Vue v-html directives. Attackers can inject malicious scripts through markdown sources or chat messages that execute in the Electron renderer process with access to Node.js APIs and the filesystem...

CVE-2026-72869: Improper Neutralization of Special Elements used in a Command

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription passes the databaseName parameter to restore builders in packages/server/src/utils/restore/utils.ts, where PostgreSQL, MariaDB, MySQL, and MongoDB commands embed the...

CVE-2026-48159: Embedded Malicious Code

use-reducer-async is a React useReducer with async actions. Between 2026-05-18 16:29:52 and 2026-05-19 15:26:07, the default branch contained malicious commits da72edbde5705efcec6c62e0a3dcb73687b78dc8 through df07d5711458d8b46e11dd7afaaa21e88cafabfb that executed remote attacker-controlled code o...

PT-2026-69910

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description An authenticated user with backup:restore permissions can execute arbitrary commands on the Docker-privileged host. The issue occurs because the backup.restoreBackupWithLogs tRPC subscription passe...

Photon OS 5.0: Nodejs PHSA-2026-5.0-91-0814

An update of the nodejs package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0814. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Nodejs PHSA-2026-5.0-92-0755

An update of the nodejs package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0755. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

ALSA-2026:52841 Important: nodejs-nodemon security update

Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. nodemon will watch the files in the directory in which nodemon was started, and if any files change, nodemon will automatically restart your node application. nodemon does...

Improper Input Validation

Electron is vulnerable to Improper Input Validation. The vulnerability is due to the mode option of webContents.openDevTools not being sanitized before use by the DevTools frontend, which allows an attacker who can influence the value to execute arbitrary script in the DevTools context and...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the construction of HTTP request URLs due to unescaped variable path components. An attacker can manipulate the URL to access unintended API endpoints or resources by supplying specially crafted repository or...

GHSA-HW7R-7V27-7388 vulnerabilities

Vulnerabilities for packages: nodejs...

GHSA-777R-4CWX-G26V vulnerabilities

Vulnerabilities for packages: nodejs...

CVE-2026-58043 vulnerabilities

Vulnerabilities for packages: nodejs...

CVE-2026-48170: Improperly Controlled Modification of Object Prototype Attributes

scim-patch, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose value object contains a key like "proto.someProp". After one such patch, Object.prototype.someProp is set process-wide, affecting every plain object in the...