Access Control

Every one of the 31 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configur…CVE-2021-22921NodeJS · 7.4% likely

   CWE-7321 bounty report

2. A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddr…CVE-2022-32212NodeJS · 6.4% likely

   CWE-2842 bounty reports

3. Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with `node --debug` or `node debug`, it listens…CVE-2018-12120The Node.js Project · 4.3% likely

   CWE-419

4. A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/ap…CVE-2023-23918NodeJS · CVSS 7.5 · 2.0% likely

   CWE-8631 bounty report

5. A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding(…CVE-2023-32559NodeJS · CVSS 7.5 · 1.8% likely

   CWE-269

6. A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument. This f…CVE-2023-32005NodeJS · CVSS 5.3 · 1.4% likely

   CWE-732

7. A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or…CVE-2023-30586NodeJS · CVSS 7.5 · 1.3% likely

   CWE-8621 bounty report

8. The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affect…CVE-2023-30581NodeJS · CVSS 7.5 · 1.1% likely

   CWE-8621 bounty report

9. setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumab…CVE-2024-22017NodeJS · CVSS 7.3 · 0.9% likely

   CWE-2501 bounty report

10. A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacke…CVE-2026-21636nodejs · CVSS 5.8 · 0.9% likely

    CWE-2841 bounty report

11. Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrectCVE-2024-30261nodejs · CVSS 2.6 · 0.8% likely

    CWE-2841 bounty report

12. A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module (node:inspector). By exploiti…CVE-2023-30587NodeJS · CVSS 7.5 · 0.7% likely

    CWE-2841 bounty report

13. Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipelineCVE-2024-30260nodejs · CVSS 3.9 · 0.7% likely

    CWE-2852 bounty reports

14. fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the `--allow-fs-read` flag in Node.js 20. This flaw arises from a mis…CVE-2023-30583NodeJS · CVSS 7.5 · 0.7% likely

    CWE-2841 bounty report

15. A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument. This f…CVE-2023-30582NodeJS · CVSS 5.3 · 0.6% likely

    CWE-2841 bounty report

16. On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exce…CVE-2024-21892NodeJS · CVSS 7.5 · 0.6% likely

    CWE-2691 bounty report

17. A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CV…CVE-2026-105482nodejs · CVSS 7.4 · 0.5% likelycovered by CyberSIXT

    CWE-2841 bounty report1 article

18. With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal wor…CVE-2025-23083NodeJS · CVSS 7.7 · 0.4% likely

    CWE-2841 bounty report

19. A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or bypass of the intend…CVE-2026-48617nodejs · CVSS 1.8 · 0.3% likelycovered by CyberSIXT

    CWE-2841 bounty report

20. A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability…CVE-2026-48930nodejs · CVSS 5.6 · 0.3% likelycovered by CyberSIXT

    CWE-2841 bounty report

21. A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utim…CVE-2025-55132nodejs · CVSS 2.8 · 0.3% likely

    CWE-2761 bounty report

22. A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, whic…CVE-2026-106073nodejs · CVSS 3.3 · 0.3% likely

    CWE-2841 bounty report

23. A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one…CVE-2026-58043nodejs · CVSS 7.5 · 0.2% likely

    CWE-2841 bounty report

24. A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: **Node.js 22**,…CVE-2026-48928nodejs · CVSS 4.2 · 0.2% likely

    CWE-2841 bounty report

25. A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to confidentiality impact or bypas…CVE-2026-58039nodejs · CVSS 3.3 · 0.2% likely

    CWE-2841 bounty report

26. A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested p…CVE-2026-106071nodejs · CVSS 3.6 · 0.2% likely

    CWE-2841 bounty report

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.