Node

Every one of the 144 is a mark on the map. Named now: 27 to 52, most at risk first.

27. A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddr…CVE-2022-32212NodeJS · 6.4% likely

    CWE-2842 bounty reports

28. Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to h…CVE-2020-8201NodeJS · 5.3% likely

    CWE-4441 bounty report

29. A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely clo…CVE-2025-59465nodejs · CVSS 7.5 · 4.0% likely

    CWE-400

30. The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR charac…CVE-2023-30589NodeJS · 3.9% likely

    2 bounty reports

31. A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all supported release lines:…CVE-2026-48933nodejs · CVSS 7.5 · 3.7% likelycovered by CyberSIXT

    CWE-1901 bounty report

32. A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific ti…CVE-2025-55131nodejs · CVSS 7.1 · 3.5% likely

    CWE-1201 bounty report

33. A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (Do…CVE-2024-22019NodeJS · CVSS 7.5 · 3.2% likely

    CWE-4042 bounty reports

34. The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6.CVE-2021-22959NodeJS · 3.2% likely

    CWE-4441 bounty report

35. A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname…CVE-2026-48618nodejs · CVSS 7.7 · 3.1% likelycovered by CyberSIXT

    CWE-1761 bounty report

36. The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.CVE-2022-35256NodeJS · CVSS 6.5 · 2.8% likely

    CWE-4442 bounty reports

37. The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain cond…CVE-2021-22960NodeJS · 2.5% likely

    CWE-4441 bounty report

38. A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set i…CVE-2023-23919NodeJS · CVSS 7.5 · 2.2% likely

    CWE-3102 bounty reports

39. A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circ…CVE-2022-32222NodeJS · 2.2% likely

    CWE-3102 bounty reports

40. Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Array` class. Node.js p…CVE-2023-39332NodeJS · 2.2% likely

    CWE-221 bounty report

41. A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. The…CVE-2022-35255NodeJS · CVSS 9.1 · 2.1% likely

    CWE-3382 bounty reports

42. A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system…CVE-2023-32004NodeJS · CVSS 8.8 · 2.1% likely

    CWE-22

43. A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/ap…CVE-2023-23918NodeJS · CVSS 7.5 · 2.0% likely

    CWE-8631 bounty report

44. A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding(…CVE-2023-32559NodeJS · CVSS 7.5 · 1.8% likely

    CWE-269

45. Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dep…CVE-2022-32223NodeJS · 1.8% likely

    CWE-427

46. The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all users using the experimental permission mo…CVE-2023-32558NodeJS · 1.7% likely

    CWE-22

47. A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directorie…CVE-2025-55130nodejs · CVSS 7.1 · 1.7% likely

    CWE-2891 bounty report

48. The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users usin…CVE-2023-32002NodeJS · CVSS 9.8 · 1.6% likely

    CWE-2881 bounty report

49. A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names a…CVE-2025-23084NodeJS · CVSS 5.6 · 1.6% likely

    CWE-221 bounty report

50. The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability af…CVE-2023-32006NodeJS · CVSS 8.8 · 1.5% likely

    CWE-693

51. A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not…CVE-2023-39331NodeJS · CVSS 7.7 · 1.5% likely

    CWE-221 bounty report

52. A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install Node.js using the .msi installer. This vul…CVE-2023-30585NodeJS · 1.5% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.