Node

Every one of the 144 is a mark on the map. Named now: 1 to 26, most at risk first.

1. An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave s…CVE-2024-27983NodeJS · CVSS 8.2 · 84% likely

   CWE-362

2. The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request S…CVE-2022-32214NodeJS · 82% likely

   CWE-444

3. Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This…CVE-2021-22883NodeJS · 77% likely

   CWE-400

4. The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smu…CVE-2022-32215NodeJS · 70% likely

   CWE-444

5. HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformedCVE-2019-15605NodeJS · 57% likely

   CWE-444

6. A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1…CVE-2020-8277NodeJS · 54% likely

   CWE-400

7. The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smug…CVE-2022-32213NodeJS · 45% likely

   CWE-444

8. Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts…CVE-2021-22884NodeJS · 37% likely

   CWE-350

9. Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.CVE-2021-22930NodeJS · 36% likely

   CWE-416

10. A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct…CVE-2026-21710nodejs · CVSS 7.5 · 25% likely

    CWE-770

11. Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased wit…CVE-2021-22918NodeJS · 23% likely

    CWE-125

12. Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name…CVE-2021-22931NodeJS · 22% likely

    CWE-170

13. Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passin…CVE-2022-21824NodeJS · 22% likely

    CWE-471

14. Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisonsCVE-2019-15606NodeJS · 20% likely

    CWE-20

15. Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificateCVE-2019-15604NodeJS · 20% likely

    CWE-295

16. Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, N…CVE-2020-8287NodeJS · 16% likely

    CWE-444

17. A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed becaus…CVE-2022-43548NodeJS · CVSS 8.1 · 15% likely

    CWE-78

18. If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expire…CVE-2021-22939NodeJS · 15% likely

    CWE-295

19. An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. This vulnerability affects Windows users o…CVE-2025-27210nodejs · CVSS 7.5 · 14% likely

    CWE-22

20. Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.CVE-2021-22940NodeJS · 14% likely

    CWE-416

21. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostname…CVE-2021-44532NodeJS · 10% likely

    CWE-296

22. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a si…CVE-2021-44533NodeJS · 9.4% likely

    CWE-295

23. Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase:…CVE-2020-8265NodeJS · 9.1% likely

    CWE-416

24. Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates…CVE-2021-44531NodeJS · 8.4% likely

    CWE-295

25. Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.CVE-2020-8251NodeJS · 8.4% likely

    CWE-400

26. Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configur…CVE-2021-22921NodeJS · 7.4% likely

    CWE-732

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.