Denial of Service

Every one of the 29 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This…CVE-2021-22883NodeJS · 77% likely

   CWE-400

2. A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1…CVE-2020-8277NodeJS · 54% likely

   CWE-400

3. Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers ver…CVE-2018-12122The Node.js Project · 41% likely

   CWE-400

4. A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct…CVE-2026-21710nodejs · CVSS 7.5 · 25% likely

   CWE-770

5. In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or…CVE-2019-5737Node.js · 16% likely

   CWE-400

6. Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized he…CVE-2018-12121The Node.js Project · 10% likely

   CWE-400

7. Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.CVE-2020-8251NodeJS · 8.4% likely

   CWE-400

8. Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into Jav…CVE-2018-7164The Node.js Project · 6.2% likely

   CWE-400

9. Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout…CVE-2019-5739Node.js · 4.9% likely

   CWE-400

10. A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely clo…CVE-2025-59465nodejs · CVSS 7.5 · 4.0% likely

    CWE-400

11. A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (Do…CVE-2024-22019NodeJS · CVSS 7.5 · 3.2% likely

    CWE-404

12. A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing…CVE-2025-23085NodeJS · CVSS 5.3 · 1.4% likely

    CWE-401

13. A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetch() function to retrieve content from…CVE-2024-22025NodeJS · CVSS 6.5 · 1.3% likely

    CWE-404

14. The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. This implementation re-introduces the HashDoS vulnerability as an attacker who c…CVE-2025-27209nodejs · CVSS 7.5 · 1.3% likely

    CWE-407

15. A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions…CVE-2026-21637nodejs · CVSS 5.9 · 1.1% likely

    CWE-400

16. Backpressure request ignored in fetch() in UndiciCVE-2024-24750nodejs · CVSS 6.5 · 0.7% likely

    CWE-400

17. A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client. This vulnerability affects…CVE-2026-48619nodejs · CVSS 5.3 · 0.6% likelycovered by CyberSIXT

    CWE-400

18. A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supported release lines: **Node.js…CVE-2026-48937nodejs · CVSS 5.3 · 0.6% likely

    CWE-400

19. A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js **24.x** a…CVE-2026-56846nodejs · CVSS 7.5 · 0.6% likely

    CWE-400

20. In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the…CVE-2025-23165nodejs · CVSS 3.7 · 0.6% likely

    CWE-401

21. Node.js is vulnerable to an HTTP/2 memory and file-descriptor leak via a protocol error during session shutdownCVE-2026-123865nodejs · CVSS 7.5 · 0.5% likelycovered by CyberSIXT

    CWE-4002 articles2 articles this week: Node.js fixes 16 flaws exposing servers to crashes and data leaks

22. Node.js is vulnerable to a remote HTTP/2 denial of service via a reachable assertion in Http2Session teardownCVE-2026-123863nodejs · CVSS 8.2 · 0.5% likelycovered by CyberSIXT

    CWE-6172 articles2 articles this week: Node.js fixes 16 flaws exposing servers to crashes and data leaks

23. Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustionCVE-2026-22036nodejs · CVSS 5.9 · 0.5% likely

    CWE-770

24. A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum val…CVE-2026-21714nodejs · CVSS 5.3 · 0.4% likely

    CWE-401

25. A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to den…CVE-2026-58042nodejs · CVSS 5.9 · 0.4% likely

    CWE-400

26. Node.js is vulnerable to an HTTP/2 memory exhaustion denial of service via unaccounted inbound DATA on an undrained streamCVE-2026-123868nodejs · CVSS 5.9 · 0.4% likelycovered by CyberSIXT

    CWE-4001 article1 article this week: Node.js fixes HTTP/2 and TLS flaws exposing data and keys

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.