CVE-2026-21712

A flaw in Node.js URL processing causes an assertion failure in native code when url.format is called with a malformed internationalized domain name IDN containing invalid characters, crashing the Node.js process...

Node.js 安全漏洞

Node.js is an open-source, cross-platform JavaScript runtime environment developed by the Node.js community. Security vulnerabilities exist in Node.js versions 20.x, 22.x, 24.x, and 25.x. These vulnerabilities stem from the lack of permission checks for FileHandle.chmod and FileHandle.chown durin...

Node.js 安全漏洞

Node.js is an open-source, cross-platform JavaScript runtime environment developed by the Node.js community. Versions 20.x, 22.x, 24.x, and 25.x of Node.js have security vulnerabilities. These vulnerabilities stem from HMAC verification using a comparison that does not maintain constant time, whi...

Node.js 安全漏洞

Node.js is an open-source, cross-platform JavaScript runtime environment developed by the Node.js community. Security vulnerabilities exist in Node.js versions 20.x, 22.x, 24.x, and 25.x. These vulnerabilities stem from a lack of permission checks for the fs.realpathSync.native method during the...

Node.js 安全漏洞

Node.js is an open-source, cross-platform JavaScript runtime environment developed by the Node.js community. Security vulnerabilities exist in Node.js versions 20.x, 22.x, 24.x, and 25.x. These vulnerabilities stem from HTTP/2 servers processing WINDOWUPDATE frames that cause the traffic control...

DSA-6183-1 nodejs - security update

Bulletin has no description...

CVE-2026-33939

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a Handlebars template contains decorator syntax referencing an unregistered decorator e.g. n, the compiled template calls lookupPropertydecorators, "n", which returns undefined. Th...

GHSA-9CX6-37PM-9JFF Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation

Summary When a Handlebars template contains decorator syntax referencing an unregistered decorator e.g. n, the compiled template calls lookupPropertydecorators, "n", which returns undefined. The runtime then immediately invokes the result as a function, causing an unhandled TypeError: ... is not ...

Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation

Summary When a Handlebars template contains decorator syntax referencing an unregistered decorator e.g. n, the compiled template calls lookupPropertydecorators, "n", which returns undefined. The runtime then immediately invokes the result as a function, causing an unhandled TypeError: ... is not ...

CVE-2021-27191

The get-ip-range package before 4.0.0 for Node.js is vulnerable to denial of service DoS if the range is untrusted input. An attacker could send a large range such as 128.0.0.0/1 that causes resource exhaustion...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception in Node.js HTTP request handling. The flaw triggers when an incoming request includes a header named proto and the server application accesses req.headersDistinct. This causes dest"proto" to incorrectly resolve to...

CVE-2026-21710

creationtimestamp| type| source ---|---|--- 2026-03-25 03:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/node-js-multiple-vulnerabilities20260325 2026-03-27 00:05:14+00:00| seen| https://bsky.app/profile/securitylab-jp.bsky.social/post/3mhyt2m5nl22l 2026-03-30 20:17:57+00:00| seen|...

CVE-2026-21711

creationtimestamp| type| source ---|---|--- 2026-03-25 03:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/node-js-multiple-vulnerabilities20260325 2026-03-30 20:08:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3michpvz46r2t...

Linux Distros Unpatched Vulnerability : CVE-2026-21713

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information...

CVE-2026-33326

Keystone is a content management system for Node.js. Prior to version 6.5.2, field.isFilterable access control can be bypassed in findMany queries by passing a cursor. This can be used to confirm the existence of records by protected field values. The fix for CVE-2025-46720 field-level isFilterab...

@brendonovich/solidjs__start (>=0.0.0, <=0.0.3), @h3ravel/arquebus (>=0.3.3, <=0.6.6) +43 more potentially affected by unknown CVE via h3 (2.0.0-rc.1)

h3 NPM version 2.0.0-rc.1 is affected by a known vulnerability. The following packages have a transitive dependency on h3 and may be impacted: - @brendonovich/solidjsstart =0.0.0, =0.3.3, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.24...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +458 more potentially affected by CVE-2026-1526 via undici (>=7.0.0, <=7.22.0)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.0.33, =0.0.1, =1.0.0, =21.0.0-rc.2, =21.0.0-rc.2, =0.5.0, =1.0.1-dev.120, =12.6.9, =1.0.1-beta.0, =1.0.1-beta.7 and more Source cves: CVE-2026-1526 Source advisory: OSV:GHSA-VRM6-8VPV-QV8Q...

EUVD-2026-11705

Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +458 more potentially affected by CVE-2026-1526 via undici (>=7.0.0, <=7.22.0)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.0.33, =0.0.1, =1.0.0, =21.0.0-rc.2, =21.0.0-rc.2, =0.5.0, =1.0.1-dev.120, =12.6.9, =1.0.1-beta.0, =1.0.1-beta.7 and more Source cves: CVE-2026-1526 Source advisory: SNYK:JS-UNDICI-15518068...

CVE-2026-2229

A flaw was found in the undici WebSocket client. A remote malicious server can exploit this vulnerability by sending a WebSocket frame with an invalid servermaxwindowbits parameter within the permessage-deflate extension. This improper validation causes the client's Node.js process to terminate,...