Memory Corruption

Every one of the 21 is a mark on the map. Named now: 1 to 21, most at risk first.

1. Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.CVE-2021-22930NodeJS · 36% likely

   CWE-416

2. Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased wit…CVE-2021-22918NodeJS · 23% likely

   CWE-125

3. Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name…CVE-2021-22931NodeJS · 22% likely

   CWE-170

4. Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.CVE-2021-22940NodeJS · 14% likely

   CWE-416

5. Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase:…CVE-2020-8265NodeJS · 9.1% likely

   CWE-416

6. In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'…CVE-2018-12115The Node.js Project · 7.8% likely

   CWE-787

7. napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.CVE-2020-8174Nodejs · 7.6% likely

   CWE-119

8. Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementati…CVE-2018-7167The Node.js Project · 6.7% likely

   CWE-119

9. A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all supported release lines:…CVE-2026-48933nodejs · CVSS 7.5 · 3.7% likelycovered by CyberSIXT

   CWE-1901 bounty report

10. Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the i…CVE-2018-21270Nodejs · 3.7% likely

    CWE-125

11. A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific ti…CVE-2025-55131nodejs · CVSS 7.1 · 3.5% likely

    CWE-1201 bounty report

12. Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction with a V8 interrupt,…CVE-2014-5256Nodejs · 3.3% likely

    CWE-119

13. Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffe…CVE-2017-15897The Node.js Project · 2.3% likely

    CWE-665

14. Node.js is vulnerable to a remotely triggerable uncaught exception in TLS servers via deferred handshake callbacksCVE-2026-126051nodejs · CVSS 7.5 · 0.8% likelycovered by CyberSIXT

    CWE-4761 article1 article this week: Node.js fixes HTTP/2 and TLS flaws exposing data and keys

15. The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the…CVE-2020-8252NodeJS · 0.7% likely

    CWE-120

16. A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free…CVE-2026-56848nodejs · CVSS 7.5 · 0.6% likelycovered by CyberSIXT

    CWE-4161 bounty report1 article

17. Node.js is vulnerable to a heap buffer overflow in HTTP/2 session.altsvc() via a long originCVE-2026-123828nodejs · CVSS 5.9 · 0.5% likelycovered by CyberSIXT

    CWE-1221 article1 article this week: Node.js fixes HTTP/2 and TLS flaws exposing data and keys

18. Node.js is vulnerable to HTTP/2 response memory disclosure via a use-after-free during stream teardownCVE-2026-123866nodejs · CVSS 7.5 · 0.5% likelycovered by CyberSIXT

    CWE-4162 articles2 articles this week: Node.js fixes 16 flaws exposing servers to crashes and data leaks

19. Node.js is vulnerable to an HTTP/2 use-after-free via respondWithFile() stream reset during a pending writeCVE-2026-123874nodejs · CVSS 7.5 · 0.5% likelycovered by CyberSIXT

    CWE-4162 articles2 articles this week: Node.js fixes 16 flaws exposing servers to crashes and data leaks

20. Node.js is vulnerable to an HTTP/2 denial of service via a NULL pointer dereference when a respondWithFile() download is cancelledCVE-2026-123875nodejs · CVSS 5.9 · 0.4% likelycovered by CyberSIXT

    CWE-4761 article1 article this week: Node.js fixes 16 flaws exposing servers to crashes and data leaks

21. Node.js is vulnerable to cross-connection memory disclosure via TLS write re-entrancy in the HTTPS request parserCVE-2026-123864nodejs · CVSS 8.1 · 0.3% likelycovered by CyberSIXT

    CWE-4161 article1 article this week: Node.js fixes 16 flaws exposing servers to crashes and data leaks

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.