nodejs: Node.js: Permission Model bypass via `process.report.writeReport()` path misvalidation

A flaw was found in Node.js. This vulnerability allows a bypass of the Permission Model enforcement due to path misvalidation within the process.report.writeReport function. An attacker could exploit this to bypass intended security boundaries, potentially leading to unauthorized access to...

Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency

A flaw was found in Node.js. An inconsistency in how Node.js matches hostnames can be exploited by a remote attacker in multi-context mTLS mutual Transport Layer Security setups. This vulnerability allows for a trust-policy bypass, potentially leading to unauthorized access to sensitive informati...

nodejs: Node.js HTTP/2 Server: Denial of Service due to continued data acceptance after GOAWAY frame

A flaw in the Node.js HTTP/2 API allows remote attackers to cause a Denial of Service DoS by sending data after a GOAWAY frame, exhausting server resources...

nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance

A flaw was found in Node.js HTTP Agent. This vulnerability allows a client to accept a server response as valid even before the client has sent its request. This can lead to unexpected behavior and potentially information disclosure...

Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency

A flaw was found in Node.js. An inconsistency in how Node.js matches hostnames can be exploited by a remote attacker in multi-context mTLS mutual Transport Layer Security setups. This vulnerability allows for a trust-policy bypass, potentially leading to unauthorized access to sensitive informati...

nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling

A flaw was found in Node.js. When proxy credentials are embedded in a proxy URL, an issue in the proxy tunnel error handling can lead to the exposure of these credentials. This information disclosure vulnerability allows an attacker to potentially capture sensitive proxy credentials through logs,...

nodejs: Node.js HTTP/2 Server: Denial of Service due to continued data acceptance after GOAWAY frame

A flaw in the Node.js HTTP/2 API allows remote attackers to cause a Denial of Service DoS by sending data after a GOAWAY frame, exhausting server resources...

nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance

A flaw was found in Node.js HTTP Agent. This vulnerability allows a client to accept a server response as valid even before the client has sent its request. This can lead to unexpected behavior and potentially information disclosure...

nodejs: Node.js: Permission Model bypass via `process.report.writeReport()` path misvalidation

A flaw was found in Node.js. This vulnerability allows a bypass of the Permission Model enforcement due to path misvalidation within the process.report.writeReport function. An attacker could exploit this to bypass intended security boundaries, potentially leading to unauthorized access to...

nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance

A flaw was found in Node.js HTTP Agent. This vulnerability allows a client to accept a server response as valid even before the client has sent its request. This can lead to unexpected behavior and potentially information disclosure...

nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames

A flaw was found in Node.js. A malicious server can exploit the HTTP/2 client by sending an unlimited number of ORIGIN frames. This can lead to an Out of Memory error on the client, resulting in a denial of service...

nodejs: Node.js HTTP/2 Server: Denial of Service due to continued data acceptance after GOAWAY frame

A flaw in the Node.js HTTP/2 API allows remote attackers to cause a Denial of Service DoS by sending data after a GOAWAY frame, exhausting server resources...

nodejs: Node.js: Permission Model bypass via `process.report.writeReport()` path misvalidation

A flaw was found in Node.js. This vulnerability allows a bypass of the Permission Model enforcement due to path misvalidation within the process.report.writeReport function. An attacker could exploit this to bypass intended security boundaries, potentially leading to unauthorized access to...

CVE-2026-14631

webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught...

nodejs: Node.js: Certification validation bypass in TLS host verification

A flaw was found in Node.js. An attacker can exploit a vulnerability in the Transport Layer Security TLS host verification process to bypass certification validation. This bypass could allow an attacker to intercept or alter communications, potentially leading to information disclosure or integri...

nodejs: Node.js: Local server can be started without network permission via Permission API flaw

A flaw was found in Node.js. The Node.js Permission API can allow a local server to be started through a Unix domain socket, even when the --allow-net permission is not explicitly granted. This bypasses intended security restrictions, potentially leading to unintended local network exposure or...

CVE-2026-14631: Improper Input Validation

webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught...

CVE-2026-58578: Inefficient Regular Expression Complexity

LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service ReDoS vulnerability that allows authenticated attackers to block the Node.js event loop by supplying a catastrophic-backtracking pattern in a GitHub repository URL path during skill import. Attackers can craf...

Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency

A flaw was found in Node.js. An inconsistency in how Node.js matches hostnames can be exploited by a remote attacker in multi-context mTLS mutual Transport Layer Security setups. This vulnerability allows for a trust-policy bypass, potentially leading to unauthorized access to sensitive informati...

nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling

A flaw was found in Node.js. This vulnerability in the TLS Transport Layer Security hostname handling allows embedded null characters in hostnames. This can lead to silent authority rebinding, potentially enabling an attacker to redirect network traffic to an unintended server and disclose...