Bypass incomplete fix of CVE-2024-27980 #2461831 Valid Command and Code Injection High 2024-07-09 – 20 fs.fchown/fchmod bypasses permission model #2472071 Valid Access Control Low 2024-07-09 – 20 Permission Model Bypass: `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write` #3838601 Valid Access Control Low 2026-07-29 – 21 Take over subdomain undici.nodejs.org.cdn.cloudflare.net #1763817 Valid Memory Corruption – 2023-01-11 – 22 Denial of Service via `__proto__` header name in `req.headersDistinct` (Uncaught `TypeError` crashes Node.js process) #3560402 Valid Denial of Service High 2026-03-30 – 22 Null Dereference in X509ToObject #3824331 Valid Memory Corruption Medium 2026-10-23 – 22 Code injection and privilege escalation through Linux capabilities #2237545 Valid Access Control – 2024-02-15 – 23 setuid() does not drop all privileges due to io_uring #2170226 Valid Access Control – 2024-03-16 – 24 Usage of unsafe random function in undici for choosing boundary #2913312 Valid Cryptography Medium 2025-01-23 – 24 Missing AES-GCM Authentication Tag Validation and Improper Deprecation Handling #3463949 Informative Cryptography High 2025-12-19 – 24 HTTPS Agent PFX object-array key collision allows mTLS client identity reuse across different per-request certificates #3816840 Valid Authentication Medium 2026-07-29 – 24 TLS certificate hostname bypass when the host loosely resolves to an IP address #4006744 Valid Cryptography High 2026-10-23 – 24 Unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion #3456148 Valid No weakness recorded – 2026-02-23 – 25 Node.js: use-after-free in TLSWrap #988103 Valid Memory Corruption – 2021-01-05 – 27 Denial of Service by resource exhaustion in fetch() brotli decoding #2284065 Valid Denial of Service – 2024-03-16 – 27 Node.js: TLS session reuse can lead to hostname verification bypass #811502 Valid Cryptography – 2020-06-03 – 29 Permission Model Bypass via `process.report.writeReport()` Path Misvalidation #3692858 Valid Access Control Low 2026-06-18 – 29 TLS certificate hostname bypass when the IP is written fullwidth digits #4038287 Valid Cryptography High 2026-10-23 – 29 Improper Input Validation — HTTP Response Parser Unconditionally Accepts Bare CR in Status Line #3648681 Valid Injection and Smuggling Medium 2026-07-01 – 30 Memory Corruption via TOCTOU Race in SharedArrayBuffer UTF-8 Decode (`StringBytes::Encode`) #3752489 Informative Race Conditions High 2026-05-23 – 32 HTTP/2 sessions never clean up after GOAWAY on invalid protocol errors #3658225 Valid Denial of Service Medium 2026-06-18 – 33 Permission Model: --allow-fs-read/--allow-fs-write radix-tree prefix-boundary over-grant #3761342 Valid Access Control High 2026-07-29 – 33 Potential HTTP Request Smuggling in nodejs #1002188 Valid Injection and Smuggling – 2021-01-07 $250 34 Memory leak that enables remote Denial of Service against applications processing TLS client certificates #3357723 Valid Denial of Service Medium 2026-02-12 – 34 fs.futimes() Bypasses Read-Only Permission Model #3390084 Valid Access Control Low 2026-01-15 – 34 FS Permissions Bypass #3417819 Valid Misconfiguration and Insecure Design High 2026-02-12 – 34 registry.nodejs.org Subdomain Takeover #340580 Valid Cryptography – 2018-05-04 – 35 Permission model improperly processes UNC paths #2079103 Valid Access Control Low 2024-07-15 – 35 Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize() #3160912 Valid File and Path Handling High 2025-07-15 – 35 Uncatchable "Maximum call stack size exceeded" error on Node.js via async_hooks leads to process crashes bypassing error handlers #3456295 Valid Input Validation and Logic Medium 2026-02-12 – 35 Permission Model bypass: process.report writes (and overwrites) files outside --allow-fs-write paths #3815767 Valid Access Control Low 2026-07-30 – 35 Path traversal by monkey-patching Buffer internals #2218653 Valid File and Path Handling – 2024-02-15 – 36 Improper error handling in async cryptographic operations crashes process #2817648 Valid Cryptography High 2025-05-14 – 37 HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934) #3812439 Valid Other weaknesses Medium 2026-07-30 – 37 Windows Device Names Still Allow Path Traversal in UNC Paths After CVE-2025-27210 Fix #3255707 Informative File and Path Handling High 2025-07-28 – 39 Assertion error in node_url.cc via malformed URL format leads to Node.js crash #3546390 Valid Denial of Service Medium 2026-03-26 – 40 Incomplete Fix for CVE-2026-21637: OCSPRequest and resumeSession Events Crash Node.js TLS Server via Unhandled Synchronous Exceptions #3781015 Informative Denial of Service High 2026-06-12 – 41 Worker permission bypass via InternalWorker leak in diagnostics #2575105 Valid Access Control High 2025-01-21 – 42 Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled #3405778 Valid Memory Corruption High 2026-02-12 – 43 WASI sandbox escape via symlink #2084280 Valid Access Control Medium 2025-05-24 – 44 NULL pointer dereference in node:sqlite DatabaseSync#applyChangeset() via malformed SQLite changeset #3736889 Informative Memory Corruption High 2026-05-23 – 44 Http request splitting #409943 Valid Injection and Smuggling – 2020-01-15 – 45 HTTP Request Smuggling via Connection: close<TAB> in Node.js llhttp parser #3723248 Valid Injection and Smuggling Medium 2026-07-31 – 49 Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS) #3465156 Valid Server-Side Request Forgery Medium 2026-02-12 – 52 HashDoS in V8 #3131758 Valid Cryptography High 2025-07-15 – 53 CWE-195 in ExternalMemoryAccounter::Increase() #3302484 Informative No weakness recorded – 2025-08-26 – 55 Path traversal by drive name in Windows environment #2307225 Valid File and Path Handling Medium 2025-01-27 – 59 Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string. #3083428 Valid Memory Corruption Low 2025-05-15 – 59 Incomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoS #3556769 Valid No weakness recorded High 2026-04-23 – 59 "Assertion failed" in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash #2319584 Valid Denial of Service – 2024-04-08 – 65