5840 matches found
PT-2026-28543
Name of the Vulnerable Software and Affected Versions elixir-nodejs versions prior to 3.1.4 Description elixir-nodejs is an Elixir API for calling Node.js functions. A flaw exists due to a race condition in the worker protocol, leading to Cross-User Data Leakage or Information Disclosure. The...
CVE-2026-27135 affecting package nodejs for versions less than 20.14.0-14
CVE-2026-27135 affecting package nodejs for versions less than 20.14.0-14. A patched version of the package is available...
GHSA-48C2-RRV3-QJMP yaml is vulnerable to Stack Overflow via deeply nested YAML collections
Parsing a YAML document with yaml may throw a RangeError due to a stack overflow. The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a RangeError: Maximum call stack size exceeded with a small payload...
CVE-2026-21717
creationtimestamp| type| source ---|---|--- 2026-03-25 16:26:55+00:00| seen| https://bsky.app/profile/nodejs.org/post/3mhvixzwybc2u 2026-03-25 16:26:56+00:00| seen| https://bsky.app/profile/nodejs.org/post/3mhviy2ktz22u 2026-03-25 16:26:56+00:00| seen|...
CVE-2026-21715
creationtimestamp| type| source ---|---|--- 2026-03-25 03:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/node-js-multiple-vulnerabilities20260325 2026-03-30 20:00:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3micharnlb322 2026-10-23 16:25:48+00:00| seen|...
CVE-2026-21716
creationtimestamp| type| source ---|---|--- 2026-03-25 03:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/node-js-multiple-vulnerabilities20260325 2026-03-30 20:05:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3michjcdym62q 2026-03-30 22:50:34+00:00| seen|...
Malicious code in @xvortexsockets/baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6fe781d4e79519992d2b0f37577515da41d7e0deb2f9f32df7c39dfb8de3916 The package @xvortexsockets/baileys was found to contain malicious code. Source: ghsa-malware...
Linux Distros Unpatched Vulnerability : CVE-2026-21710
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request is received with a header named proto and the application accesses...
Linux Distros Unpatched Vulnerability : CVE-2026-21716
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An incomplete fix for CVE-2024-36137 leaves FileHandle.chmod and FileHandle.chown in the promises API without the required permission checks, while their...
Linux Distros Unpatched Vulnerability : CVE-2026-21712
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in Node.js URL processing causes an assertion failure in native code when url.format is called with a malformed internationalized domain name IDN...
Linux Distros Unpatched Vulnerability : CVE-2026-71717
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - nodejs - None CVE-2026-71717 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable, Inc...
Linux Distros Unpatched Vulnerability : CVE-2026-21715
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync.native without the required read permission checks, while all comparable...
Linux Distros Unpatched Vulnerability : CVE-2026-21714
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOWUPDATE frames on stream 0 connection-level that cause the flow control window to exceed...
Node.js: Permission Model bypass via FileHandle.utimes() in the promises API
Vulnerability description not provided...
MAL-2026-2365 Malicious code in env-nodejs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9fdb2ca296901d2020b959a63ec369c661ac063698529ced5230cd04717a5c0 The package env-nodejs was found to contain malicious code...
Malicious code in env-nodejs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9fdb2ca296901d2020b959a63ec369c661ac063698529ced5230cd04717a5c0 The package env-nodejs was found to contain malicious code...
Tuesday, March 24, 2026 Security Releases
Tuesday, March 24, 2026 Security Releases Security releases available Updates are now available for the 25.x, 24.x, 22.x, 20.x Node.js release lines for the following issues. This security release includes the following dependency updates to address public vulnerabilities: undici 6.24.1, 7.24.4 o...
AZL-81540 CVE-2026-4450 affecting package nodejs for versions less than 24.14.1-3
Out of bounds write in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...
K000160399: Node.js vulnerability CVE-2025-59464
Security Advisory Description A memory leak in Node.js’s OpenSSL integration occurs when converting X.509 certificate fields to UTF-8 without freeing the allocated buffer. When applications call socket.getPeerCertificatetrue, each certificate field leaks memory, allowing remote clients to trigger...
