Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
253 results · page 2 of 6
Jun 5, 2026HAX CMS helps manage microsite universe with PHP or NodeJs backends.CVE-2026-46400 · Other software · haxtheweb · reported by GitHubHigh 8.7
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 11.0.6 and prior to version 25.0.0, the file upload functionality in HAXCMS PHP only validates file extensions using a regex pattern without checking the actual file content or MIME type. This allows attackers to upload malicious files (e.g., PHP webshells) disguised as legitimate image files, potentially leading to remote code execution. Version 25.0.0 contains a fix for the issue.
- Product
- haxcms-php
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2026HAX CMS helps manage microsite universe with PHP or NodeJs backends.CVE-2026-46398 · Other software · haxtheweb · reported by GitHubHigh 8.8
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 25.0.0 and prior to version 26.0.0, the haxcms_refresh_token cookie is set without the Secure flag. This allows it to be transmitted over unencrypted HTTP, making it vulnerable to theft via packet sniffing on the network. Version 26.0.0 fixes the issue.
- Product
- haxcms-php
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2026HAX CMS helps manage microsite universe with PHP or NodeJs backends.CVE-2026-46397 · Other software · haxtheweb · reported by GitHubMedium 6.5
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an Authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server (www-data). Version 26.0.0 patches the issue.
- Product
- haxcms-php
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2026HAX CMS helps manage microsite universe with PHP or NodeJs backends.CVE-2026-46357 · Other software · haxtheweb · reported by GitHubMedium 6.5
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the HAX CMS NodeJS application crashes when an authenticated attacker sends a specially crafted site creation request to the createSite endpoint. A single request is sufficient to take the entire application offline, requiring a manual server restart to restore service. Version 26.0.0 fixes the issue.
- Product
- haxcms-nodejs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2026HAX CMS helps manage microsite universe with PHP or NodeJs backends.CVE-2026-46511 · Other software · haxtheweb · reported by GitHubHigh 8.7
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing Stored XSS alongside dynamic token exposure in the `/system/api/connectionSettings` endpoint allows an authenticated attacker to perform a complete cross-tenant account takeover. The API dynamically leaks the active session's authentication tokens (including the `jwt`, `user_token`, `site_token`, and `appstore_token`) into a global JavaScript variable (`window.appSettings`). An attacker can exploit the XSS vulnerability to force a victim's browser to silently fetch their specific connection settings, extract the tokens, and exfiltrate them to an attacker-controlled webhook. Version 26.0.0 patches the issue.
- Product
- haxcms-nodejs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2026HAX CMS helps manage microsite universe with PHP or NodeJs backends.CVE-2026-46496 · Other software · haxtheweb · reported by GitHubCritical 9.3
HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of the `<video-player>` component. The component allows `javascript:` URIs in the `source` attribute, which are executed when the page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim’s browser and access sensitive data such as JWT tokens and more. Version 26.0.0 fixes the issue.
- Product
- haxcms-nodejs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2026HAX CMS helps manage microsite universe with PHP or NodeJs backends.CVE-2026-46399 · Other software · haxtheweb · reported by GitHubCritical 9.4
HAX CMS helps manage microsite universe with PHP or NodeJs backends. The PHP version of HAX CMS prior to version 26.0.0 has an authenticated file overwrite vulnerability. An attacker can exploit this vulnerability to configure malicious Git filter commands and achieve code execution on the HAX CMS server. Version 26.0.0 patches the issue.
- Product
- haxcms-nodejs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2026HAX CMS helps manage microsite universe with PHP or NodeJs backends.CVE-2026-46396 · Other software · haxtheweb · reported by GitHubCritical 9.3
HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of `<iframe>` elements. The application allows `javascript:` URIs in the `src` attribute, which are executed when a malicious page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim’s browser and access sensitive data exposed to client-side scripts. Version 26.0.0 fixes the issue.
- Product
- haxcms-nodejs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2026HAX CMS helps manage microsite universe with PHP or NodeJs backends.CVE-2026-46395 · Other software · haxtheweb · reported by GitHubCritical 9.3
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the `hmacBase64()` function in the HAXcms Node.js backend contains two critical cryptographic implementation errors that together allow any unauthenticated attacker to extract the system’s private signing key and forge arbitrary admin-level JSON Web Tokens (JWTs) allowing them to get full admin access with a single HTTP request. First, the function passes the literal string "0" as the HMAC signing key instead of the key parameter, making every HAXcms instance compute identical HMACs for the same input. Then, after computing the HMAC, the function concatenates the real key parameter which is "this.privateKey + this.salt", the system’s master signing secret is directly onto the output. The combined buffer is base64-encoded and returned as the token. Every base64url token produced has the same structure: 32 bytes HMAC keyed with "0" and N bytes of `privateKey+salt`. An attacker base64-decodes any token, discards the first 32 bytes, and reads the private key directly. The `/system/api/connectionSettings` endpoint is unauthenticated and returns multiple tokens generated by this function. A sing
- Product
- haxcms-nodejs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2026HAX CMS helps manage microsite universe with PHP or NodeJs backends.CVE-2026-46394 · Other software · haxtheweb · reported by GitHubHigh 7.7
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an OS command injection vulnerability exists in the Git.php library of the HAXcms PHP backend. The application constructs shell command strings using unsanitized input and executes them via proc_open(). An attacker who can control parameters passed into Git operations can execute arbitrary OS commands with the privileges of the web server. Out of 17 functions that invoke shell commands only 1 function (`commit()`) correctly uses `escapeshellarg()`. When combined with another vulnerability that allows configuration manipulation, this issue can lead to full remote code execution and complete system compromise. Version 26.0.0 patches the issue.
- Product
- haxcms-php
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2026HAX CMS helps manage microsite universe with PHP or NodeJs backends.CVE-2026-46393 · Other software · haxtheweb · reported by GitHubHigh 7.1
HAX CMS helps manage microsite universe with PHP or NodeJs backends. An authenticated Server-Side Request Forgery (SSRF) vulnerability in versions prior to 26.0.0 allows authenticated users to fetch arbitrary internal or local resources and write the responses to a web-accessible directory, enabling arbitrary file read and internal network access. Version 26.0.0 contains a fix.
- Product
- haxcms-nodejs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2026HAX CMS helps manage microsite universe with PHP or NodeJs backends.CVE-2026-46392 · Other software · haxtheweb · reported by GitHubHigh 8.7
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0 of HAX CMS PHP, the `saveFile` endpoint validates upload extensions case-insensitively and writes the filename to disk verbatim, but the `.htaccess` rule that forces `Content-Disposition: attachment` on HTML files is case-sensitive. An HTML file uploaded with an uppercase extension (`.HTML`, `.Html`, `.HTM`) is still served as `text/html` but the forced-download header never applies, so the browser renders it inline and executes any embedded JavaScript in the HAXcms origin. This bypasses the mitigation shipped for CVE-2026-22704. Version 26.0.0 contains a fix.
- Product
- haxcms-php
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2026HAX CMS helps manage microsite universe with PHP or NodeJs backends.CVE-2026-46391 · Other software · haxtheweb · reported by GitHubHigh 8.7
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and prior to version 26.0.0 of @haxtheweb/open-apis, multiple functions conduct substring-only matching to validate hostnames to which basic authorization should be sent. An attacker can append the matched substrings to an attacker-controlled endpoint and capture authentication. Version 26.0.0 fixes the issue.
- Product
- @haxtheweb/open-apis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2026HAX CMS helps manage microsite universe with PHP or NodeJs backends.CVE-2026-46390 · Other software · haxtheweb · reported by GitHubMedium 6.9
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 2.0.0 and prior to version 26.0.0, the gitlist plugin is exposed to unauthenticated users, allowing unauthenticated browsing of git repositories and git history. Version 26.0.0 patches the issue.
- Product
- haxcms-php
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026HAX CMS helps manage microsite universe with PHP or NodeJs backends.CVE-2026-48527 · Other software · haxtheweb · reported by GitHubHigh 8.7
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions up to and including 26.0.0 are affected by a stored cross-site scripting (XSS) vulnerability in the `/system/api/saveNode` endpoint. An authenticated user with a permission to edit pages can bypass the HTML sanitizer by injecting an event handler attribute without whitespace before the attribute name. @haxtheweb/haxcms-nodejs 26.0.1 and haxcms-php 26.0.2 patch the issue.
- Product
- haxcms-nodejs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026HAX CMS helps manage microsite universe with PHP or NodeJs backends.CVE-2026-35185 · Other software · haxtheweb · reported by GitHubHigh 8.7
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens (user_token), user activity, client IP addresses, and server configuration details. This allows any unauthenticated user to monitor real-time user interactions and gather internal infrastructure information. This vulnerability is fixed in 25.0.0.
- Product
- HAXiam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable.CVE-2026-21717 · Other software · nodejs · reported by support@hackerone.comMedium 5.9
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process. The most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while theiCVE-2026-21716 · Other software · nodejs · reported by support@hackerone.comLow 3.3
An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched. As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable fiCVE-2026-21715 · Other software · nodejs · reported by support@hackerone.comLow 3.3
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to excCVE-2026-21714 · Other software · nodejs · reported by support@hackerone.comMedium 5.3
A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up. This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportCVE-2026-21713 · Other software · nodejs · reported by support@hackerone.comMedium 5.9
A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values. Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all compaCVE-2026-21711 · Other software · nodejs · reported by support@hackerone.comMedium 5.3
A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary. This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `CVE-2026-21710 · Other software · nodejs · reported by support@hackerone.comHigh 7.5
A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodejs.orgaccess.redhat.com
Mar 30, 2026A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN) cCVE-2026-21712 · Other software · nodejs · reported by support@hackerone.comMedium 6.5
A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comnodejs.org
Mar 27, 2026elixir-nodejs provides an Elixir API for calling Node.js functions.CVE-2026-33872 · Other software · revelrylabs · reported by GitHubHigh 7.1
elixir-nodejs provides an Elixir API for calling Node.js functions. A vulnerability in versions prior to 3.1.4 results in Cross-User Data Leakage or Information Disclosure due to a race condition in the worker protocol. The lack of request-response correlation creates a "stale response" vulnerability. Because the worker does not verify which request a response belongs to, it may return the next available data in the buffer to an unrelated caller. In high-throughput environments where the library processes sensitive user data (e.g., PII, authentication tokens, or private records), a timeout or high concurrent load can cause Data A (belonging to User A) to be returned to User B. This may lead to unauthorized information disclosure that is difficult to trace, as the application may not throw an error but instead provide "valid-looking" yet entirely incorrect and private data to the wrong session. The issue is fixed in v3.1.4.
- Product
- elixir-nodejs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026TerriaJS-Server is a NodeJS Express server for TerriaJS, a library for building web-based geospatial data explorers.CVE-2026-27818 · Other software · TerriaJS · reported by GitHubHigh 8.7
TerriaJS-Server is a NodeJS Express server for TerriaJS, a library for building web-based geospatial data explorers. A validation bug in versions prior to 4.0.3 allows an attacker to proxy domains not explicitly allowed in the `proxyableDomains` configuration. Version 4.0.3 fixes the issue.
- Product
- terriajs-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2026Openfire 4.6.0 contains a stored cross-site scripting vulnerability in the nodejs plugin that allows attackers to inject malicious scripts through the 'path' paCVE-2020-36956 · Other software · igniterealtime · reported by VulnCheckMedium 5.1
Openfire 4.6.0 contains a stored cross-site scripting vulnerability in the nodejs plugin that allows attackers to inject malicious scripts through the 'path' parameter. Attackers can craft a payload with script tags to execute arbitrary JavaScript in the context of administrative users viewing the nodejs configuration page.
- Product
- Openfire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Jan 20, 2026A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use.CVE-2026-21637 · Other software · nodejs · reported by support@hackerone.comHigh 7.5
A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled.CVE-2026-21636 · Other software · nodejs · reported by support@hackerone.comCritical 10
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution. * The issue affects users of the Node.js permission model on version v25. In the moment of this vulnerability, network permissions (`--allow-net`) are still in the experimental phase.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabledCVE-2025-59466 · Other software · nodejs · reported by support@hackerone.comHigh 7.5
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`.CVE-2025-59465 · Other software · nodejs · reported by support@hackerone.comHigh 7.5
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example: ``` server.on('secureConnection', socket => { socket.on('error', err => { console.log(err) }) }) ```
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodejs.orgaccess.redhat.com
Jan 20, 2026A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer.CVE-2025-59464 · Other software · nodejs · reported by support@hackerone.comHigh 7.5
A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`, each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permisCVE-2025-55132 · Other software · nodejs · reported by support@hackerone.comMedium 5.3
A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout optionCVE-2025-55131 · Other software · nodejs · reported by support@hackerone.comHigh 7.1
A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data corruption. While exploitation typically requires precise timing or in-process code execution, it can become remotely exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality and integrity impact.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodejs.orgaccess.redhat.com
Jan 20, 2026A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths.CVE-2025-55130 · Other software · nodejs · reported by support@hackerone.comCritical 9.1
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodejs.orgaccess.redhat.com
Jan 14, 2026Undici is an HTTP/1.1 client for Node.js.CVE-2026-22036 · Other software · nodejs · reported by GitHubMedium 5.9
Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0.
- Product
- undici
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2026HAX CMS helps manage microsite universe with PHP or NodeJs backends.CVE-2026-22704 · Other software · haxtheweb · reported by GitHubHigh 8
HAX CMS helps manage microsite universe with PHP or NodeJs backends. In versions 11.0.6 to before 25.0.0, HAX CMS is vulnerable to stored XSS, which could lead to account takeover. This issue has been patched in version 25.0.0.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2025HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends.CVE-2025-54378 · Other software · haxtheweb · reported by GitHubHigh 8.3
HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends. In versions 11.0.13 and below of haxcms-nodejs and versions 11.0.8 and below of haxcms-php, API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS do not verify that a user has permission to interact with a resource before performing a given operation. The API endpoints within the HAX CMS application check if a user is authenticated, but don't check for authorization before performing an operation. This is fixed in versions 11.0.14 of haxcms-nodejs and 11.0.9 of haxcms-php.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2025HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend.CVE-2025-54139 · Other software · haxtheweb · reported by GitHubMedium 4.3
HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend. In haxcms-nodejs versions 11.0.12 and below and in haxcms-php versions 11.0.7 and below, all pages within the HAX CMS application do not contain headers to prevent other websites from loading the site within an iframe. This applies to both the CMS and generated sites. An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application. This is fixed in haxcms-nodejs version 11.0.13 and haxcms-php 11.0.8.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2025HAX CMS NodeJS allows users to manage their microsite universe with a NodeJS backend.CVE-2025-54137 · Other software · haxtheweb · reported by GitHubHigh 7.3
HAX CMS NodeJS allows users to manage their microsite universe with a NodeJS backend. Versions 11.0.9 and below were distributed with hardcoded default credentials for the user and superuser accounts. Additionally, the application has default private keys for JWTs. Users aren't prompted to change credentials or secrets during installation, and there is no way to change them through the UI. An unauthenticated attacker can read the default user credentials and JWT private keys from the public haxtheweb GitHub repositories. These credentials and keys can be used to access unconfigured self-hosted instances of the application, modify sites, and perform further attacks. This is fixed in version 11.0.10.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend.CVE-2025-54134 · Other software · haxtheweb · reported by GitHubHigh 7.1
HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.8 and below, the HAX CMS NodeJS application crashes when an authenticated attacker provides an API request lacking required URL parameters. This vulnerability affects the listFiles and saveFiles endpoints. This vulnerability exists because the application does not properly handle exceptions which occur as a result of changes to user-modifiable URL parameters. This is fixed in version 11.0.9.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend.CVE-2025-54128 · Other software · haxtheweb · reported by GitHubHigh 7.2
HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.7 and below, the NodeJS version of HAX CMS has a disabled Content Security Policy (CSP). This configuration is insecure for a production application because it does not protect against cross-site-scripting attacks. The contentSecurityPolicy value is explicitly disabled in the application's Helmet configuration in app.js. This is fixed in version 11.0.8.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025HAXcms with nodejs backend allows users to start the server in any HAXsite or HAXcms instance.CVE-2025-54127 · Other software · haxtheweb · reported by GitHubCritical 9.3
HAXcms with nodejs backend allows users to start the server in any HAXsite or HAXcms instance. In versions 11.0.6 and below, the NodeJS version of HAXcms uses an insecure default configuration designed for local development. The default configuration does not perform authorization or authentication checks. If a user were to deploy haxcms-nodejs without modifying the default settings, ‘HAXCMS_DISABLE_JWT_CHECKS‘ would be set to ‘true‘ and their deployment would lack session authentication. This is fixed in version 11.0.7.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX.CVE-2025-27210 · Other software · nodejs · reported by support@hackerone.comHigh 7.5
An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. This vulnerability affects Windows users of `path.join` API.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodejs.orgopenwall.com
Jul 18, 2025The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash.CVE-2025-27209 · Other software · nodejs · reported by support@hackerone.comHigh 7.5
The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. This implementation re-introduces the HashDoS vulnerability as an attacker who can control the strings to be hashed can generate many hash collisions - an attacker can generate collisions even without knowing the hash-seed. * This vulnerability affects Node.js v24.x users.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodejs.orgopenwall.com
Jul 11, 2025haxcms-nodejs and haxcms-php are backends for HAXcms.CVE-2025-53642 · Other software · haxtheweb · reported by GitHubMedium 4.8
haxcms-nodejs and haxcms-php are backends for HAXcms. The logout function within the application does not terminate a user's session or clear their cookies. Additionally, the application issues a refresh token when logging out. This vulnerability is fixed in 11.0.6.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2025A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`.CVE-2025-23167 · Other software · nodejs · reported by support@hackerone.comMedium 6.5
A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests. The issue was resolved by upgrading `llhttp` to version 9, which enforces correct header termination. Impact: * This vulnerability affects only Node.js 20.x users prior to the `llhttp` v9 upgrade.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2025The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the CVE-2025-23166 · Other software · nodejs · reported by support@hackerone.comHigh 7.5
The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2025In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently ovCVE-2025-23165 · Other software · nodejs · reported by support@hackerone.comLow 3.7
In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service. Impact: * This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025Undici is an HTTP/1.1 client for Node.js.CVE-2025-47279 · Other software · nodejs · reported by GitHubLow 3.1
Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.
- Product
- undici
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.