[ Vendor · 9 CVEs ]
nodejs
CVEs affecting nodejs published in the last 30 days, plus any nodejs CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-106071 | 23 Oct 2026 | CVSS 3.6 | nodejs nodeA flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or… | |
| CVE-2026-106072 | 23 Oct 2026 | CVSS 6.7 | nodejs nodeA flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a… | |
| CVE-2026-106073 | 23 Oct 2026 | CVSS 3.3 | nodejs nodeA flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an… | |
| CVE-2026-106074 | 23 Oct 2026 | CVSS 4.8 | nodejs nodeA flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be… | |
| CVE-2026-105481 | 23 Oct 2026 | CVSS 6.5 | nodejs nodeA flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request… | |
| CVE-2026-105482 | 23 Oct 2026 | CVSS 7.4 | nodejs nodeA flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse()… | |
| CVE-2026-105483 | 23 Oct 2026 | CVSS 7.4 | nodejs nodeA flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address… | |
| CVE-2026-106069 | 23 Oct 2026 | CVSS 7.4 | nodejs nodeA flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client… | |
| CVE-2026-106070 | 23 Oct 2026 | CVSS 3.7 | nodejs nodeA flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header… |