CVE-2024-22025 vulnerabilities

Vulnerabilities for packages: nodejs...

GHSA-52XJ-VX8W-46QJ vulnerabilities

Vulnerabilities for packages: nodejs...

CVE-2026-21637 vulnerabilities

Vulnerabilities for packages: nodejs...

GHSA-WJ24-GWH6-MGH8 vulnerabilities

Vulnerabilities for packages: nodejs...

CVE-2023-46809 vulnerabilities

Vulnerabilities for packages: nodejs...

CVE-2023-39333 vulnerabilities

Vulnerabilities for packages: nodejs...

CVE-2024-22019 vulnerabilities

Vulnerabilities for packages: nodejs...

CVE-2025-59465 vulnerabilities

Vulnerabilities for packages: nodejs...

GHSA-XFGW-QCMV-354J vulnerabilities

Vulnerabilities for packages: nodejs...

GHSA-PRHJ-8562-P8GJ vulnerabilities

Vulnerabilities for packages: nodejs...

GHSA-HG6J-8H7M-3W3J vulnerabilities

Vulnerabilities for packages: nodejs...

SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:0301-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0301-1 advisory. Security fixes: - CVE-2026-22036: Fixed unbounded decompression chain in HTTP response leading to resource exhaustion bsc1256848 -...

NewStart CGSL MAIN 6.06 : nodejs Multiple Vulnerabilities (NS-SA-2025-0241)

The remote NewStart CGSL host, running version MAIN 6.06, has nodejs packages installed that are affected by multiple vulnerabilities: - The use of Module.load can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects...

CVE-2025-57283

Node.js package browserstack-local v1.5.8 contains a command‑injection vulnerability. The logfile variable is not properly sanitized in lib/Local.js, allowing an attacker to cause arbitrary OS commands to execute when the variable is processed. Exploitation is contingent on the attacker’s ability...

CVE-2020-36956

Openfire 4.6.0 contains a stored cross-site scripting vulnerability in the nodejs plugin that allows attackers to inject malicious scripts through the 'path' parameter. Attackers can craft a payload with script tags to execute arbitrary JavaScript in the context of administrative users viewing th...

@a0dotrun/expose (>=0.0.2, <=0.0.4), @agentforce/adk (>=0.9.0, <=0.12.1) +338 more potentially affected by CVE-2026-24472 via hono (>=4.0.0, <=4.11.6)

hono NPM version =4.0.0, =0.0.2, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =2.0.0-beta.66, =2.0.0-beta.66, =0.0.1, =0.0.1, =0.0.1-experimental.1, =1.7.2, =1.7.1, =1.8.0 and more Source cves: CVE-2026-24472 Source advisory: SNYK:JS-HONO-15123484...

CVE-2026-22709

vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, Promise.prototype.then Promise.prototype.catch callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code. In lib/setup-sandbox.js, the callback function of...

CVE-2026-22709 vm2 has a Sandbox Escape

vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, Promise.prototype.then Promise.prototype.catch callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code. In lib/setup-sandbox.js, the callback function of...

CVE-2026-22709 vm2 has a Sandbox Escape

vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, Promise.prototype.then Promise.prototype.catch callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code. In lib/setup-sandbox.js, the callback function of...

CVE-2020-36956

Openfire 4.6.0 contains a stored cross-site scripting vulnerability in the nodejs plugin that allows attackers to inject malicious scripts through the 'path' parameter. Attackers can craft a payload with script tags to execute arbitrary JavaScript in the context of administrative users viewing th...