Node.js Cross-border Deletion Data Compromise

The vulnerability of the Node.js software platform is related to errors in cross-border deletion of critical data. Exploiting this vulnerability can allow a malicious actor to compromise the confidentiality and integrity of the protected information...

Node.js Path Traversal

The vulnerability of the Node.js software platform is related to incorrect restrictions on path names for directories with restricted access. Exploiting this vulnerability can allow an attacker to compromise the system...

Node.js jsPDF library < 4.0.0 Local File Inclusion / Path Traversal Vulnerability

The version of jsPDF installed on the remote host is prior to 4.0.0. It is, therefore, affected by a local file inclusion / path traversal vulnerability in its Node.js builds. - The vulnerability exists in the Node.js environment of the library, specifically within the loadFile method and its...

Mageia: Security Advisory (MGASA-2026-0009)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OESA-2026-1168 nodejs-js-yaml security update

This is an implementation of YAML YAML Ain't Markup Language, a human friendly data serialization language. It started as PyYAML port, and was completely rewritten from scratch. Now it's very fast, and supports the 1.2 spec. Security Fixes: js-yaml is a JavaScript YAML parser and dumper. In js-ya...

OESA-2026-1166 nodejs-js-yaml security update

This is an implementation of YAML YAML Ain't Markup Language, a human friendly data serialization language. It started as PyYAML port, and was completely rewritten from scratch. Now it's very fast, and supports the 1.2 spec. Security Fixes: js-yaml is a JavaScript YAML parser and dumper. In js-ya...

OESA-2026-1167 nodejs-js-yaml security update

This is an implementation of YAML YAML Ain't Markup Language, a human friendly data serialization language. It started as PyYAML port, and was completely rewritten from scratch. Now it's very fast, and supports the 1.2 spec. Security Fixes: js-yaml is a JavaScript YAML parser and dumper. In js-ya...

OESA-2026-1169 nodejs-js-yaml security update

This is an implementation of YAML YAML Ain't Markup Language, a human friendly data serialization language. It started as PyYAML port, and was completely rewritten from scratch. Now it's very fast, and supports the 1.2 spec. Security Fixes: js-yaml is a JavaScript YAML parser and dumper. In js-ya...

Node.js async_hooks DoS

The vulnerability of the createHook function in the asynchooks module of the Node.js software platform is related to an uncontrolled recursion. Exploiting this vulnerability could allow a malicious actor to trigger a service failure remotely...

MCPJam Inspector Connect API Command Execution

This module exploits an unauthenticated command execution vulnerability in MCPJam Inspector. The /api/mcp/connect endpoint accepts a JSON serverConfig object containing a command and argument list used to start an MCP server. A remote attacker can abuse this endpoint to execute arbitrary operatin...

Node.js: HashDoS in V8

Vulnerability description not provided...

Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion

Impact The fetch API supports chained HTTP encoding algorithms for response content according to RFC 9110 e.g., Content-Encoding: gzip, br. This is also supported by the undici decompress interceptor. However, the number of links in the decompression chain is unbounded and the default maxHeaderSi...

CVE-2024-36138 vulnerabilities

Vulnerabilities for packages: nodejs...

EUVD-2026-2422

Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This...

Exploit for CVE-2025-68428

🚨 jsPDF Bulk Detector – CVE-2025-68428 🚨 Asset-wide detecti...

Linux Distros Unpatched Vulnerability : CVE-2025-59464

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A memory leak in Node.js's OpenSSL integration occurs when converting X.509 certificate fields to UTF-8 without freeing the allocated buffer. When applications...

Linux Distros Unpatched Vulnerability : CVE-2026-22036

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize...

CVE-2026-22036: Allocation of Resources Without Limits or Throttling

Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This...

CVE-2026-22686: Protection Mechanism Failure

Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.7.0, there is a critical sandbox escape vulnerability in enclave-vm that allows untrusted, sandboxed JavaScript code to execute arbitrary code in the host Node.js runtime. When a tool invocation fails,...

Linux Distros Unpatched Vulnerability : CVE-2026-21637

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when pskCallback or ALPNCallback are in use...