Node.js · weakness class
Information Disclosure
10 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 10 is a mark on the map. Named now: 1 to 10, most at risk first.
- The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with ar…
- Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.
- In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended to be safe and only r…
- Undici's cookie header not cleared on cross-origin redirect in fetch
- Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undici
- Undici vulnerable to data leak when using response.arrayBuffer()
- A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the proxy URL, they may b…
- A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number…
- Node.js is vulnerable to proxy credential disclosure via ERR_PROXY_INVALID_CONFIG error messages
- Node.js is vulnerable to Permission Model file-name disclosure via recursive fs.watch
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP