Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

333new WordPress flaws this week

390,007entries in the database

253 results · page 1 of 6

Oct 23, 2026A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into CVE-2026-106074 · Other software · nodejs · reported by support@hackerone.comMedium 4.8
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`. If any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 `randomInt()` values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodejs.org
Oct 23, 2026A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks.CVE-2026-106073 · Other software · nodejs · reported by support@hackerone.comLow 3.3
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodejs.org
Oct 23, 2026A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonicCVE-2026-106072 · Other software · nodejs · reported by support@hackerone.comMedium 6.7
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`. `tls.checkServerIdentity()` did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing `DNS:127.0.0.1` and no `IP Address:127.0.0.1` SAN was therefore accepted, while the same certificate is correctly rejected for `127.0.0.1`. Exploitation requires a certificate with a numeric DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such as glibc. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodejs.org
Oct 23, 2026A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.CVE-2026-106071 · Other software · nodejs · reported by support@hackerone.comLow 3.6
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043. This vulnerability affects Node.js **26.x**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodejs.org
Oct 23, 2026A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation faCVE-2026-106070 · Other software · nodejs · reported by support@hackerone.comLow 3.7
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When `zipEntry.modified` is read on an archive whose local header does not match its central directory, either directly or while compacting the archive, the validation error is caught but the parsed local header is left cached without a content offset. A later content read then returns attacker-controlled bytes from the start of the file instead of rejecting the archive, and CRC-32 verification still passes because the attacker controls the central directory CRC. A Node.js-based scanner can therefore approve different content from what another ZIP implementation extracts from the same archive. This vulnerability affects Node.js **26.x**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodejs.org
Oct 23, 2026A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, CVE-2026-106069 · Other software · nodejs · reported by support@hackerone.comHigh 7.4
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`. `tls.checkServerIdentity()` normalizes the host following the WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the connection is made through the operating system resolver, which on some platforms such as macOS reads it as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate issued for another IP address. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodejs.org
Oct 23, 2026A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the hostCVE-2026-105483 · Other software · nodejs · reported by support@hackerone.comHigh 7.4
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`). `tls.checkServerIdentity()` did not recognize such hosts as IP addresses, even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate DNS names and Common Name instead. A certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618. This vulnerability affects Node.js **26.x** and **24.x**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodejs.org
Oct 23, 2026A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse().CVE-2026-105482 · Other software · nodejs · reported by support@hackerone.comHigh 7.4
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodejs.org
Oct 23, 2026A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request.CVE-2026-105481 · Other software · nodejs · reported by support@hackerone.comMedium 6.5
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodejs.org
Oct 16, 2026Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.CVE-2026-109461 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.9
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.
Product
Microsoft Identity Client for NodeJS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 14, 2026nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying craftedCVE-2026-110644 · Other software · ChetanXpro · reported by VulnCheckCritical 9.3
nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $() command substitution or closing quotes, which are interpolated into an ffmpeg command run via shelljs exec(), executing OS commands with Node.js process privileges.
Product
nodejs-whisper
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 8, 2026MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases.CVE-2026-107385 · Other software · mariadb-corporation · reported by GitHubHigh 7.4
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NO_BACKSLASH_ESCAPES mode, including in Connection.escape(). When that mode is enabled, the backslash is an ordinary character, so an attacker-controlled placeholder value can close the SQL string literal and inject arbitrary SQL with the application's database privileges. The vulnerable configuration may be enabled server-wide, through connector initialization options, or with an application-issued SET sql_mode; execute() and batch() use binary protocols and are not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.
Product
mariadb-connector-nodejs
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 8, 2026MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases.CVE-2026-107384 · Other software · mariadb-corporation · reported by GitHubHigh 8.1
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processed by escapeId. An attacker-controlled key containing a backtick can close the quoted identifier and cause the remainder of the key to be interpreted as SQL. This can update columns the application did not intend to expose and can append arbitrary SQL with the database user's privileges. The option is disabled by default, and serialized-object handling used when it is disabled is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.
Product
mariadb-connector-nodejs
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 8, 2026MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases.CVE-2026-107383 · Other software · mariadb-corporation · reported by GitHubHigh 7.5
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe() allocation from each ring's numeric length before confirming that the ring is an array. A malformed non-array ring can therefore reserve bytes that the writing loop skips, and the connector sends the full buffer through execute() or batch(), disclosing uninitialized Node.js heap data into a database value. The persisted data can include other users' content, session material, database credentials, or TLS key material and may propagate to backups and replicas. The text-protocol query() path is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.
Product
mariadb-connector-nodejs
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 8, 2026MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases.CVE-2026-107382 · Other software · mariadb-corporation · reported by GitHubMedium 5.9
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.3.0 until 3.5.4, the zero-configuration TLS fingerprint-validation path calls Ed25519PasswordAuth.hash() through Authentication.validateFingerPrint, but Ed25519PasswordAuth.hash() references a seed identifier that is not in scope. Exposure requires a MariaDB server reached over TCP, TLS enabled with ssl: true or an ssl object whose rejectUnauthorized value is not false, a password set, no ssl.ca configured, and client_ed25519 negotiated as the authentication plugin. Under those conditions, a legitimate server, malicious server, or network attacker presenting a self-signed certificate can reach this path and cause a synchronous ReferenceError to escape the socket data handler. Under Node.js default uncaught-exception behavior, the client process terminates, causing denial of service. Configurations using a provided CA, rejectUnauthorized: false, another authentication plugin, or a Unix socket do not reach this vulnerable path. This issue is fixed in version 3.5.4.
Product
mariadb-connector-nodejs
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 2, 2026Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang bindings.CVE-2026-83745 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.7
Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang bindings. Both bindings' WebSocket server transports read the payload length out of the frame header and allocate that many bytes immediately, without checking that the bytes have arrived. A single ~14-byte frame therefore commits as much memory as it cares to declare -- measured at 513 MiB against the Node.js server and 2 GiB against the D transport -- and in the Node.js case the connection is left open afterwards, so the frame can simply be sent again. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Product
Apache Thrift
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org lists.apache.org
Oct 2, 2026Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings.CVE-2026-96294 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.7
Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Product
Apache Thrift
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org lists.apache.org
Oct 2, 2026Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings.CVE-2026-94645 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.2
Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Product
Apache Thrift
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org lists.apache.org
Sep 9, 2026A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and includinCVE-2025-7062 · Other software · Lumi Education UG · reported by 23637b5d-af4c-4cf9-b8f6-deb7fd0f8423Medium 5.2
A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content.
Product
h5p-nodejs-library
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com schutzwerk.com
Aug 31, 2026A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncominCVE-2026-48932 · Other software · nodejs · reported by support@hackerone.comLow 3.7
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection. Node.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hackerone.com
Aug 28, 2026MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases.CVE-2026-55855 · Other software · mariadb-corporation · reported by GitHubMedium 6.5
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js permits SQL injection when attacker-controlled Buffer parameters are escaped client-side under the big5, gbk, sjis, cp932, or gb18030 client character sets. PacketOutputStream.writeBufferEscape in lib/io/packet-output-stream.js escaped bytes without the charset-aware getMbRecognizer logic in lib/misc/charset-mb.js. The server SQL lexer runs my_ismbchar before escape processing, so an attacker-controlled lead byte can consume the inserted 0x5C backslash as a multibyte trail byte and leave the following 0x27 quote unescaped, terminating the string literal and allowing arbitrary SQL. The default utf8mb4 character set and parameters sent through the execute binary prepared-statement path are not affected. Successful exploitation can expose or modify data available to the database account. This issue is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3.
Product
mariadb-connector-nodejs
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 28, 2026MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases.CVE-2026-55854 · Other software · mariadb-corporation · reported by GitHubMedium 5.9
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js can disclose an account password when PAM dialog authentication is negotiated over an insecure transport. In lib/cmd/handshake/auth/pam-password-auth.js and lib/cmd/handshake/authentication.js, the SendPamAuthPacketFactory behavior for the server-side plugin dialog lacked the secure-transport gate applied to mysql_clear_password. With the default sslMode=DISABLE and restrictedAuth=null settings, a hostile or on-path server can send an Authentication Switch Request for dialog over plain TCP, causing the connector to return the account password in cleartext. Properly verified TLS and a local Unix socket prevent this path, while fingerprint-only server identity validation is not sufficient. This issue is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3.
Product
mariadb-connector-nodejs
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 28, 2026MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases.CVE-2026-55215 · Other software · mariadb-corporation · reported by GitHubHigh 7.5
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/Node.js sends credentials before completing certificate fingerprint validation. In lib/cmd/handshake/auth/handshake.js, a server that selects mysql_clear_password as the initial authentication plugin can receive the password before the post-TLS identity check. In lib/cmd/handshake/authentication.js, an authentication switch can evaluate the previous plugin instead of the requested target plugin, allowing mysql_clear_password to send the credential first. An active man-in-the-middle can present a self-signed certificate, capture the database password, and use it to authenticate directly even though the connector later rejects the server and closes the connection. This issue is fixed in versions 3.3.3, 3.4.6, and 3.5.3.
Product
mariadb-connector-nodejs
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 4, 2026A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a CVE-2026-56848 · Other software · nodejs · reported by support@hackerone.comHigh 7.5
A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodejs.org
Aug 3, 2026A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process toCVE-2026-58045 · Other software · nodejs · reported by support@hackerone.comMedium 6.2
A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodejs.org
Aug 3, 2026A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncominCVE-2026-58044 · Other software · nodejs · reported by support@hackerone.comLow 3.7
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection. Node.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodejs.org
Aug 3, 2026A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records.CVE-2026-58042 · Other software · nodejs · reported by support@hackerone.comMedium 5.9
A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to denial of service. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodejs.org
Aug 3, 2026A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statemeCVE-2026-58041 · Other software · nodejs · reported by support@hackerone.comMedium 5.3
A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodejs.org
Aug 3, 2026A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion.CVE-2026-56846 · Other software · nodejs · reported by support@hackerone.comHigh 7.5
A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js **24.x** and **22.x**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodejs.org
Jul 30, 2026A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths.CVE-2026-58039 · Other software · nodejs · reported by support@hackerone.comLow 3.3
A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodejs.org
Jul 30, 2026A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.CVE-2026-58043 · Other software · nodejs · reported by support@hackerone.comHigh 8.4
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodejs.org
Jul 30, 2026An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026CVE-2026-58040 · Other software · nodejs · reported by support@hackerone.comMedium 6.3
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934). This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodejs.org
Jul 30, 2026A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requeCVE-2026-56850 · Other software · nodejs · reported by support@hackerone.comMedium 4.4
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodejs.org
Jul 30, 2026A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`.CVE-2026-56847 · Other software · nodejs · reported by support@hackerone.comMedium 6.1
A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodejs.org
Jul 1, 2026OS command injection in the NodejsFunction Docker bundling pipeline (OsCommand helper) in AWS aws-cdk-lib on all platforms might allow a actor who controls depeCVE-2026-13760 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5High 7
OS command injection in the NodejsFunction Docker bundling pipeline (OsCommand helper) in AWS aws-cdk-lib on all platforms might allow a actor who controls dependency version strings in a project's package.json file to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters in the OsCommand helper. This issue requires the actor to control the content of a package.json dependency version string that is processed during Docker-based bundling with nodeModules specified. To remediate this issue, users should upgrade to v2.260.0.
Product
AWS CDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record aws.amazon.com github.com
Jun 25, 2026A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission.CVE-2026-48936 · Other software · nodejs · reported by support@hackerone.comLow 3.3
A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission. This vulnerability affects one supported release line: **Node.js 26**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodejs.org
Jun 25, 2026A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g.CVE-2026-48935 · Other software · nodejs · reported by support@hackerone.comLow 3.3
A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodejs.org
Jun 25, 2026A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.CVE-2026-48934 · Other software · nodejs · reported by support@hackerone.comMedium 4.3
A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodejs.org
Jun 25, 2026A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB.CVE-2026-48933 · Other software · nodejs · reported by support@hackerone.comHigh 7.5
A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodejs.org access.redhat.com
Jun 25, 2026A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings.CVE-2026-48930 · Other software · nodejs · reported by support@hackerone.comCritical 9.8
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodejs.org
Jun 25, 2026A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups.CVE-2026-48928 · Other software · nodejs · reported by support@hackerone.comMedium 5.4
A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodejs.org
Jun 25, 2026A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client.CVE-2026-48619 · Other software · nodejs · reported by support@hackerone.comHigh 7.5
A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodejs.org
Jun 25, 2026A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver anCVE-2026-48618 · Other software · nodejs · reported by support@hackerone.comMedium 6.5
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodejs.org access.redhat.com
Jun 25, 2026A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages.CVE-2026-48615 · Other software · nodejs · reported by support@hackerone.comHigh 7.5
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodejs.org
Jun 22, 2026A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request.CVE-2026-48931 · Other software · nodejs · reported by support@hackerone.comLow 3.7
A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nodejs.org openwall.com
Jun 18, 2026A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame.CVE-2026-48937 · Other software · nodejs · reported by support@hackerone.comHigh 7.5
A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supported release lines: **Node.js 22** and **Node.js 24**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hackerone.com nodejs.org
Jun 18, 2026A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation.CVE-2026-48617 · Other software · nodejs · reported by support@hackerone.comHigh 8.2
A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Product
node
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hackerone.com nodejs.org
Jun 10, 2026OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2.246.0 on Windows) might allow an actor who controls the valuCVE-2026-11417 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5High 7
OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2.246.0 on Windows) might allow an actor who controls the value of one or more bundling properties (externalModules, define, loader, inject, or esbuildArgs) to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters. This issue requires the threat actor to control the value of one or more of the affected bundling properties in the CDK application. To remediate this issue, users should upgrade to aws-cdk-lib 2.245.0 (2.246.0 on Windows) or later.
Product
AWS Cloud Development Kit library
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record aws.amazon.com github.com
Jun 5, 2026HAX CMS helps manage microsite universe with PHP or NodeJs backends.CVE-2026-46493 · Other software · haxtheweb · reported by GitHubHigh 7.5
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.1 use `uniqid` for generating salts, which is unsuitable. Version 26.0.1 fixes the issue.
Product
haxcms-php
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 5, 2026HAX CMS helps manage microsite universe with PHP or NodeJs backends.CVE-2026-46401 · Other software · haxtheweb · reported by GitHubMedium 5.3
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.0 suffer from an improper session termination vulnerability where authentication tokens remain valid after user logout. This allows attackers who obtain valid tokens to maintain persistent access to authenticated CMS functionality, bypassing the intended session termination mechanism and enabling unauthorized access to CMS metadata and administrative functions. Version 26.0.0 fixes the issue.
Product
issues
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.