en
Node.js is a free, open-source, cross-platform JavaScript runtime project maintained by the Node.js community and supported within the OpenJS ecosystem. Its primary purpose is to run JavaScript for servers, web applications, command-line tools, and scripts, using an asynchronous event-driven model.
Severity across 118 analyzed records
As of 09/11/2026, nodejs recorded 24 security vulnerabilities in the last 90 days across 1 products, including 5 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Node had the most security vulnerabilities in the nodejs ecosystem, with 24 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
| CVE | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-48932CVE-2026-48932 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published09/01/2026 | SeverityLow |
CVE-2026-56848CVE-2026-56848 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published08/04/2026 | SeverityHigh |
CVE-2026-58042CVE-2026-58042 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published08/04/2026 | SeverityMedium |
CVE-2026-56846CVE-2026-56846 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published08/04/2026 | SeverityHigh |
CVE-2026-58044CVE-2026-58044 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published08/04/2026 | SeverityLow |
CVE-2026-58045CVE-2026-58045 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published08/04/2026 | SeverityMedium |
CVE-2026-58041CVE-2026-58041 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published08/04/2026 | SeverityMedium |
CVE-2026-58039CVE-2026-58039 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published07/31/2026 | SeverityLow |
CVE-2026-56847CVE-2026-56847 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published07/30/2026 | SeverityLow |
CVE-2026-58043CVE-2026-58043 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published07/30/2026 | SeverityHigh |
CVE-2026-56850CVE-2026-56850 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published07/30/2026 | SeverityMedium |
CVE-2026-58040CVE-2026-58040 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published07/30/2026 | SeverityMedium |
CVE-2026-15157undici vulnerable to CRLF Injection via blob-like body 'type' property | Exploitation statusNot known exploited | FixYes | Affected productundici | Published07/29/2026 | SeverityMedium |
CVE-2026-14643undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives | Exploitation statusNot known exploited | FixYes | Affected productundici | Published07/29/2026 | SeverityMedium |
CVE-2026-16728undici vulnerable to downstream response desynchronization via retry interceptor | Exploitation statusNot known exploited | FixYes | Affected productundici | Published07/29/2026 | SeverityMedium |
CVE-2026-16729undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields | Exploitation statusNot known exploited | FixYes | Affected productundici | Published07/29/2026 | SeverityMedium |
CVE-2026-13697undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives | Exploitation statusNot known exploited | FixYes | Affected productundici | Published07/29/2026 | SeverityHigh |
CVE-2026-48930CVE-2026-48930 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published06/26/2026 | SeverityMedium |
CVE-2026-48928CVE-2026-48928 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published06/26/2026 | SeverityMedium |
CVE-2026-48934CVE-2026-48934 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published06/26/2026 | SeverityMedium |
CVE-2026-48936CVE-2026-48936 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published06/26/2026 | SeverityLow |
CVE-2026-48618CVE-2026-48618 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published06/26/2026 | SeverityHigh |
CVE-2026-48933CVE-2026-48933 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published06/26/2026 | SeverityHigh |
CVE-2026-48935CVE-2026-48935 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published06/26/2026 | SeverityLow |
CVE-2026-48619CVE-2026-48619 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published06/26/2026 | SeverityMedium |
CVE-2026-48615CVE-2026-48615 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published06/26/2026 | SeverityMedium |
CVE-2026-48931CVE-2026-48931 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published06/22/2026 | SeverityLow |
CVE-2026-48937CVE-2026-48937 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published06/18/2026 | SeverityMedium |
CVE-2026-48617CVE-2026-48617 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published06/18/2026 | SeverityLow |
CVE-2026-11525undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching | Exploitation statusNot known exploited | FixYes | Affected productundici | Published06/17/2026 | SeverityLow |
CVE-2026-6733undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse | Exploitation statusNot known exploited | FixYes | Affected productundici | Published06/17/2026 | SeverityLow |
CVE-2026-9678undici vulnerable to cross-user information disclosure via shared cache whitespace bypass | Exploitation statusNot known exploited | FixYes | Affected productundici | Published06/17/2026 | SeverityMedium |
CVE-2026-9679undici vulnerable to HTTP header injection via Set-Cookie percent-decoding | Exploitation statusNot known exploited | FixYes | Affected productundici | Published06/17/2026 | SeverityMedium |
CVE-2026-9697undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent | Exploitation statusNot known exploited | FixYes | Affected productundici | Published06/17/2026 | SeverityHigh |
CVE-2026-6734undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse | Exploitation statusNot known exploited | FixYes | Affected productundici | Published06/17/2026 | SeverityHigh |
CVE-2026-9675undici WebSocket client vulnerable to denial of service via cumulative fragment bypass | Exploitation statusNot known exploited | FixYes | Affected productundici | Published06/17/2026 | SeverityHigh |
CVE-2026-12151undici WebSocket client vulnerable to denial of service via fragment count bypass | Exploitation statusNot known exploited | FixYes | Affected productundici | Published06/17/2026 | SeverityHigh |
CVE-2026-21710CVE-2026-21710 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published03/30/2026 | SeverityHigh |
CVE-2026-21716CVE-2026-21716 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published03/30/2026 | SeverityLow |
CVE-2026-21711CVE-2026-21711 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published03/30/2026 | SeverityMedium |
CVE-2026-21715CVE-2026-21715 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published03/30/2026 | SeverityLow |
CVE-2026-21717CVE-2026-21717 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published03/30/2026 | SeverityMedium |
CVE-2026-21713CVE-2026-21713 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published03/30/2026 | SeverityMedium |
CVE-2026-21714CVE-2026-21714 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published03/30/2026 | SeverityMedium |
CVE-2026-21712CVE-2026-21712 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published03/30/2026 | SeverityMedium |
CVE-2026-2229undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation | Exploitation statusNot known exploited | FixNot confirmed | Affected productundici | Published03/12/2026 | SeverityHigh |
CVE-2026-1528undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client | Exploitation statusNot known exploited | FixYes | Affected productundici | Published03/12/2026 | SeverityHigh |
CVE-2026-1527undici is vulnerable to CRLF Injection via upgrade option | Exploitation statusNot known exploited | FixNot confirmed | Affected productundici | Published03/12/2026 | SeverityMedium |
CVE-2026-2581undici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoS | Exploitation statusNot known exploited | FixYes | Affected productundici | Published03/12/2026 | SeverityMedium |
CVE-2026-1526undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression | Exploitation statusNot known exploited | FixNot confirmed | Affected productundici | Published03/12/2026 | SeverityHigh |
CVE-2026-1525undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | Exploitation statusPublic exploit | FixNot confirmed | Affected productundici | Published03/12/2026 | SeverityMedium |
CVE-2026-21636CVE-2026-21636 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published01/20/2026 | SeverityMedium |
CVE-2025-59466CVE-2025-59466 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published01/20/2026 | SeverityMedium |
CVE-2025-55132CVE-2025-55132 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published01/20/2026 | SeverityLow |
CVE-2025-59464CVE-2025-59464 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published01/20/2026 | SeverityMedium |
CVE-2025-55131CVE-2025-55131 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published01/20/2026 | SeverityHigh |
CVE-2025-55130CVE-2025-55130 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published01/20/2026 | SeverityHigh |
CVE-2026-21637CVE-2026-21637 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published01/20/2026 | SeverityMedium |
CVE-2025-59465CVE-2025-59465 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published01/20/2026 | SeverityHigh |
CVE-2026-22036Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion | Exploitation statusNot known exploited | FixYes | Affected productundici | Published01/14/2026 | SeverityMedium |
CVE-2025-27210CVE-2025-27210 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published07/18/2025 | SeverityHigh |
CVE-2025-27209CVE-2025-27209 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published07/18/2025 | SeverityHigh |
CVE-2025-23165CVE-2025-23165 | Exploitation statusPublic exploit | FixYes | Affected productNode | Published05/19/2025 | SeverityLow |
CVE-2025-23166CVE-2025-23166 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published05/19/2025 | SeverityHigh |
CVE-2025-23167CVE-2025-23167 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published05/19/2025 | SeverityMedium |
CVE-2025-47279undici Denial of Service attack via bad certificate data | Exploitation statusPublic exploit | FixYes | Affected productundici | Published05/15/2025 | SeverityLow |
CVE-2025-23085CVE-2025-23085 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published02/07/2025 | SeverityMedium |
CVE-2025-23084CVE-2025-23084 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published01/28/2025 | SeverityMedium |
CVE-2025-23083CVE-2025-23083 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published01/22/2025 | SeverityHigh |
CVE-2025-22150Undici Uses Insufficiently Random Values | Exploitation statusPublic exploit | FixYes | Affected productundici | Published01/21/2025 | SeverityMedium |
CVE-2024-27980CVE-2024-27980 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published01/09/2025 | SeverityHigh |
CVE-2024-37372CVE-2024-37372 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published01/09/2025 | SeverityLow |
CVE-2023-46809CVE-2023-46809 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published09/07/2024 | SeverityHigh |
CVE-2024-36138CVE-2024-36138 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published09/07/2024 | SeverityHigh |
CVE-2023-39333CVE-2023-39333 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published09/07/2024 | SeverityMedium |
CVE-2024-36137CVE-2024-36137 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published09/07/2024 | SeverityLow |
CVE-2023-30582CVE-2023-30582 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published09/07/2024 | SeverityMedium |
CVE-2023-30587CVE-2023-30587 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published09/07/2024 | SeverityHigh |
CVE-2023-30583CVE-2023-30583 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published09/07/2024 | SeverityHigh |
CVE-2023-30584CVE-2023-30584 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published09/07/2024 | SeverityHigh |
CVE-2024-22018CVE-2024-22018 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published07/10/2024 | SeverityLow |
CVE-2024-22020CVE-2024-22020 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published07/09/2024 | SeverityMedium |
CVE-2024-38372Undici vulnerable to data leak when using response.arrayBuffer() | Exploitation statusPublic exploit | FixYes | Affected productundici | Published07/08/2024 | SeverityLow |
CVE-2024-27982CVE-2024-27982 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published05/07/2024 | SeverityMedium |
CVE-2024-3566Command injection vulnerability in programing languages on Microsoft Windows operating system. | Exploitation statusPublic exploit | FixNot confirmed | Affected productNode.js | Published04/10/2024 | SeverityCritical |
CVE-2024-27983CVE-2024-27983 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published04/09/2024 | SeverityHigh |
CVE-2024-30260Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline | Exploitation statusNot known exploited | FixYes | Affected productundici | Published04/04/2024 | SeverityLow |
CVE-2024-30261Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect | Exploitation statusPublic exploit | FixYes | Affected productundici | Published04/04/2024 | SeverityLow |
CVE-2024-22025CVE-2024-22025 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published03/19/2024 | SeverityMedium |
CVE-2024-22017CVE-2024-22017 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published03/19/2024 | SeverityHigh |
CVE-2024-21896CVE-2024-21896 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published02/20/2024 | SeverityHigh |
CVE-2024-21890CVE-2024-21890 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published02/20/2024 | SeverityMedium |
CVE-2024-21891CVE-2024-21891 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published02/20/2024 | SeverityHigh |
CVE-2024-22019CVE-2024-22019 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published02/20/2024 | SeverityHigh |
CVE-2024-21892CVE-2024-21892 | Exploitation statusNot known exploited | FixYes | Affected productNode | Published02/20/2024 | SeverityHigh |
CVE-2024-24750Backpressure request ignored in fetch() in Undici | Exploitation statusNot known exploited | FixNot confirmed | Affected productundici | Published02/16/2024 | SeverityMedium |
CVE-2024-24758Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undici | Exploitation statusNot known exploited | FixYes | Affected productundici | Published02/16/2024 | SeverityLow |
CVE-2023-30590CVE-2023-30590 | Exploitation statusNot confirmed | FixYes | Affected productNode | Published11/28/2023 | SeverityUnknown |
CVE-2023-30588CVE-2023-30588 | Exploitation statusNot confirmed | FixYes | Affected productNode | Published11/28/2023 | SeverityUnknown |
CVE-2023-30585CVE-2023-30585 | Exploitation statusNot confirmed | FixYes | Affected productNode | Published11/28/2023 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
