en
Node.js is a free, open-source, cross-platform JavaScript runtime project maintained by the Node.js community and supported within the OpenJS ecosystem. Its primary purpose is to run JavaScript for servers, web applications, command-line tools, and scripts, using an asynchronous event-driven model.
As of 10/22/2026, NodeJS recorded 12 security vulnerabilities in the last 90 days across 1 products, including 3 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, node had the most security vulnerabilities in the NodeJS ecosystem, with 12 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-87029undici vulnerable to Denial of Service via unhandled exception in the decompress interceptorCVE-2026-109932undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG bufferingCVE-2026-87018undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiationCVE-2026-109383undici vulnerable to TLS certificate validation bypass via dropped tls options in AgentCVE-2026-109829undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects279 Results | Page 1 of 28
| SeverityMedium |
| SeverityHigh |
| SeverityHigh |
| SeverityHigh |
| SeverityMedium |
| SeverityMedium |
| SeverityHigh |
| SeverityHigh |
| SeverityMedium |