nodejs node.js
188 known vulnerabilities across versions
Vulnerabilities are listed by affected version. Select any CVE for the full briefing and its intelligence graph.
pskCallback or `HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash by triggering an unhandled `TLSX.509 certificate fields to UTF-8 without freeing the alfutimes() even when th--allow-fs-read and --allow-fs-write restrictions using craintegrity option passed to fetch(),fetch(url) and not consuming the innode:fs functions allow specifying paths as either strings or Uint8Array objects. In Node.js environments, the `Bufferprocess.binding() can bypass the permission model through path traversal. This vulnerability affModule._load() can bypass the policy mechanism and require modules outside of the policy.json definition for a givenmodule.constructor.createRequire() can bypass the policy mechanism and require modules outside of the policy.json deffs.mkdtemp() and fs.mkdtempSync() can be used to bypass the permission model check using a path traversal attack. This flaw arHeaders.set() and Headers.append() methods are vulnerab=< undici@5.8.0 users are vulnerable to _CRLF Injection_ on headeundici is vulnerable to SSRF (Server-side Request Forgery) when aUndici.ProxyAgent never verifies the remote server's certificate, and always exposes all request & response data to the proxy. TBuffer.alloc() to return uninitialized memoContent-Length header, allowing input such as `Content-'path' module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. Theares_parse_naptr_reply(), which is used for parsing NAPTR responses, could be triggered to read memory outsi