11788 matches found
Important: nodejs:22 security, bug fix, and enhancement update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...
CVE-2026-50272
dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/textmap.js parsed incoming baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES on...
CVE-2026-54335: Improperly Controlled Modification of Object Prototype Attributes
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In 5.0.44 and earlier, the .mergetarget, source utility exported by @feathersjs/commons recursively merges source into target by iterating Object.keyssource. When source was produced by...
CVE-2026-50272: Allocation of Resources Without Limits or Throttling
dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/textmap.js parsed incoming baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES on...
RLSA-2026:39868 Important: nodejs:24 security, bug fix, and enhancement update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...
nodejs24 security, bug fix, and enhancement update
1:24.18.0-1.0.1 - Update upstream references 1:24.18.0-1 - Update to version 24.18.0 1:24.14.1-3 - De-bundle c-ares and libuv...
nodejs22 security, bug fix, and enhancement update
1:22.23.1-2 - CVE-2026-42338 ip-address HTML escaping fix. 1:22.23.1-1 - Update to version 22.23.1 1:22.22.2-2 - De-bundle c-ares, libuv - we waited for c-ares for about 4 months, so added conditional flag in case it falls behind in future again, same for libuv...
@ai-growth/n8n-nodes-wordpress (>=0.2.0, <=0.6.12), @henry2323/n8n-nodes-calendar-tool-wrapper (0.1.4) +38 more potentially affected by CVE-2026-59259 via n8n-core (>=1.0.0, <=1.122.34)
n8n-core NPM version =1.0.0, =0.2.0, =1.0.1, =0.26.0, =0.34.0, =1.0.1, =0.21.8, =1.0.0, =1.0.0, =0.1.0, =1.0.1, =0.3.3, =0.1.3, =0.1.1, =1.2.0, =1.4.1 and more Source cves: CVE-2026-59259 Source advisory: SNYK:JS-N8NCORE-18017737...
K000162282: Node.js vulnerabilities CVE-2026-48931 and CVE-2026-48934
Security Advisory Description CVE-2026-48931 A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26. CVE-2026-48934 A flaw in...
nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance
A flaw was found in Node.js HTTP Agent. This vulnerability allows a client to accept a server response as valid even before the client has sent its request. This can lead to unexpected behavior and potentially information disclosure...
nodejs: Node.js: Permission Model bypass via `process.report.writeReport()` path misvalidation
A flaw was found in Node.js. This vulnerability allows a bypass of the Permission Model enforcement due to path misvalidation within the process.report.writeReport function. An attacker could exploit this to bypass intended security boundaries, potentially leading to unauthorized access to...
nodejs: Node.js HTTP/2 Server: Denial of Service due to continued data acceptance after GOAWAY frame
A flaw in the Node.js HTTP/2 API allows remote attackers to cause a Denial of Service DoS by sending data after a GOAWAY frame, exhausting server resources...
GHSA-9HC2-HJX8-Q6PV TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Module Auto-Execution
Description TidGi Desktop through 0.13.0 contains a critical remote code execution vulnerability exploitable via a single Git repository import. The vulnerability leverages TiddlyWiki's module system, which automatically discovers and executes JavaScript code embedded in .tid files placed in the...
js-x-ray v@nodesecure/[email protected]
!slsa...
nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling
A flaw was found in Node.js. This vulnerability in the TLS Transport Layer Security hostname handling allows embedded null characters in hostnames. This can lead to silent authority rebinding, potentially enabling an attacker to redirect network traffic to an unintended server and disclose...
nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance
A flaw was found in Node.js HTTP Agent. This vulnerability allows a client to accept a server response as valid even before the client has sent its request. This can lead to unexpected behavior and potentially information disclosure...
nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling
A flaw was found in Node.js. When proxy credentials are embedded in a proxy URL, an issue in the proxy tunnel error handling can lead to the exposure of these credentials. This information disclosure vulnerability allows an attacker to potentially capture sensitive proxy credentials through logs,...
nodejs: Node.js: Permission Model bypass via `process.report.writeReport()` path misvalidation
A flaw was found in Node.js. This vulnerability allows a bypass of the Permission Model enforcement due to path misvalidation within the process.report.writeReport function. An attacker could exploit this to bypass intended security boundaries, potentially leading to unauthorized access to...
nodejs: Node.js: Unauthorized file metadata modification
A flaw was found in Node.js. The Permission API allows a local user to modify file metadata on paths that have been explicitly set as read-only. This can lead to unauthorized changes in file properties, impacting the integrity of the file system...
nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch
A flaw was found in Node.js. This flaw involves a mismatch in how Node.js handles TLS Transport Layer Security hostnames and unicode dot separators during authentication. This mismatch can lead to a wildcard-depth authentication bypass. An attacker could exploit this to bypass intended security...