Input Validation and Logic

Every one of the 19 is a mark on the map. Named now: 1 to 19, most at risk first.

1. The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large numbe…CVE-2013-4450Nodejs · 37% likely

   CWE-20

2. Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisonsCVE-2019-15606NodeJS · 20% likely

   CWE-20

3. Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (uncaught exception and crash) by leveraging a change in the zli…CVE-2017-14919Nodejs · 8.3% likely

   CWE-20

4. All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 ser…CVE-2018-7161The Node.js Project · 7.5% likely

   CWE-20

5. The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to byp…CVE-2016-2216Nodejs · 7.3% likely

   CWE-20

6. All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node process which provides an http serv…CVE-2018-7162The Node.js Project · 6.6% likely

   CWE-20

7. Node.js 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allow remote attackers to conduct HTTP request smuggling attacks via a crafted Content…CVE-2016-2086Nodejs · 6.3% likely

   CWE-20

8. Node.js v4.0 through v4.8.3, all versions of v5.x, v6.0 through v6.11.0, v7.0 through v7.10.0, and v8.0 through v8.1.3 was susceptible to hash flooding remote DoS attacks as the H…CVE-2017-11499Nodejs · 5.4% likely

   CWE-20

9. Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option o…CVE-2018-12116The Node.js Project · 4.6% likely

   CWE-115

10. Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() t…CVE-2018-12123The Node.js Project · 4.0% likely

    CWE-115

11. The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value…CVE-2018-7159The Node.js Project · 3.5% likely

    CWE-115

12. The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and…CVE-2018-7158The Node.js Project · 3.5% likely

    CWE-185

13. The Update method in src/node_http_parser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string, which allows remote attackers to obtain…CVE-2012-2330Nodejs · 2.6% likely

    CWE-20

14. Undici vulnerable to Regular Expression Denial of Service in HeadersCVE-2023-24807nodejs · CVSS 7.5 · 1.3% likely

    CWE-20

15. The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Su…CVE-2025-23166nodejs · CVSS 7.5 · 0.8% likely

    CWE-248

16. We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reachi…CVE-2025-59466nodejs · CVSS 5.9 · 0.7% likely

    CWE-248

17. A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When `zipEntry…CVE-2026-106070nodejs · CVSS 3.7 · 0.4% likely

    CWE-840

18. A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN) containing invalid c…CVE-2026-21712nodejs · CVSS 5.7 · 0.3% likely

    CWE-20

19. Node.js is vulnerable to a zlib denial of service via a stream destroy during a pending params() callCVE-2026-123862nodejs · CVSS 2.9 · 0.1% likely

    CWE-248

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.