Node

Every one of the 144 is a mark on the map. Named now: 105 to 130, most at risk first.

105. A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permission Model do not operat…CVE-2024-36137NodeJS · CVSS 3.3 · 0.4% likely

     2 bounty reports

106. A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When `zipEntry…CVE-2026-106070nodejs · CVSS 3.7 · 0.4% likely

     CWE-840

107. A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number…CVE-2026-21713nodejs · CVSS 5.9 · 0.4% likely

     CWE-2081 bounty report

108. Node.js is vulnerable to a client certificate authentication bypass via TLS 1.2 renegotiation servername changeCVE-2026-123872nodejs · CVSS 8.1 · 0.4% likelycovered by CyberSIXT

     CWE-2872 articles2 articles this week: Node.js fixes 16 flaws exposing servers to crashes and data leaks

109. A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass w…CVE-2023-30584NodeJS · CVSS 7.7 · 0.3% likely

     CWE-221 bounty report

110. A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup s…CVE-2026-106074nodejs · CVSS 4.8 · 0.3% likely

     CWE-330

111. A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects all supported release…CVE-2026-48931nodejs · CVSS 3.7 · 0.3% likely

     CWE-3671 bounty report

112. Node.js is vulnerable to cross-connection memory disclosure via TLS write re-entrancy in the HTTPS request parserCVE-2026-123864nodejs · CVSS 8.1 · 0.3% likelycovered by CyberSIXT

     CWE-4161 article1 article this week: Node.js fixes 16 flaws exposing servers to crashes and data leaks

113. A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN) containing invalid c…CVE-2026-21712nodejs · CVSS 5.7 · 0.3% likely

     CWE-201 bounty report

114. A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of C…CVE-2026-105481nodejs · CVSS 6.5 · 0.3% likely

     CWE-3671 bounty report

115. A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or bypass of the intend…CVE-2026-48617nodejs · CVSS 1.8 · 0.3% likelycovered by CyberSIXT

     CWE-2841 bounty report

116. An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934). This vulne…CVE-2026-58040nodejs · CVSS 6.3 · 0.3% likely

     CWE-2971 bounty report

117. A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability…CVE-2026-48930nodejs · CVSS 5.6 · 0.3% likelycovered by CyberSIXT

     CWE-2841 bounty report

118. A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a…CVE-2026-106069nodejs · CVSS 7.4 · 0.3% likelycovered by CyberSIXT

     CWE-2951 bounty report1 article

119. A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with no…CVE-2026-105483nodejs · CVSS 7.4 · 0.3% likelycovered by CyberSIXT

     CWE-2951 bounty report1 article

120. A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has bee…CVE-2026-58041nodejs · CVSS 5.3 · 0.3% likely

     CWE-3671 bounty report

121. A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that c…CVE-2026-21717nodejs · CVSS 5.9 · 0.3% likely

     CWE-3281 bounty report

122. A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers w…CVE-2026-58044nodejs · CVSS 3.7 · 0.3% likely

     CWE-4441 bounty report

123. A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers w…CVE-2026-48932nodejs · CVSS 3.7 · 0.3% likely

     CWE-4441 bounty report

124. A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getP…CVE-2025-59464nodejs · CVSS 6.5 · 0.3% likely

     CWE-4001 bounty report

125. A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utim…CVE-2025-55132nodejs · CVSS 2.8 · 0.3% likely

     CWE-2761 bounty report

126. A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js…CVE-2026-48934nodejs · CVSS 4.3 · 0.3% likely

     CWE-2951 bounty report

127. A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, whic…CVE-2026-106073nodejs · CVSS 3.3 · 0.3% likely

     CWE-2841 bounty report

128. A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one…CVE-2026-58043nodejs · CVSS 7.5 · 0.2% likely

     CWE-2841 bounty report

129. A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process to crash. All 11 sync…CVE-2026-58045nodejs · CVSS 6.2 · 0.2% likely

     CWE-4001 bounty report

130. A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: **Node.js 22**,…CVE-2026-48928nodejs · CVSS 4.2 · 0.2% likely

     CWE-2841 bounty report

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.