Vulnerability in http-parser & embedded NULL header handling #536954 Valid Memory Corruption – 2020-02-13 – 1 Http response is not ended although underlying socket is already destroyed #676710 Informative Denial of Service – 2020-01-15 – 1 Use After Free in crypto.randomFill #340053 Informative Memory Corruption – 2020-01-15 – 2 Node.js HTTP/2 Large Settings Frame DoS #446662 Valid Denial of Service – 2020-07-02 – 2 CRLF Injection in legacy url API (url.parse().hostname) #771596 Informative Injection and Smuggling – 2020-01-10 – 2 DNS Max Responses for DOS #1033107 Valid Denial of Service – 2020-12-16 $250 2 Node.js Certificate Verification Bypass via String Injection #1429694 Valid Cryptography – 2022-02-10 – 2 Out of order TLS handshake / application data messages lead to segmentation fault #335495 Valid Memory Corruption – 2020-02-13 – 3 Fix for CVE-2018-12122 can be bypassed via keep-alive requests #453513 Valid Denial of Service – 2020-02-13 – 3 loader.js is not secure #629879 N/A Command and Code Injection – 2020-06-11 – 3 Hostname spoofing #678487 Informative No weakness recorded – 2020-01-10 – 3 Child process environment injection via prototype pollution #878181 Informative Command and Code Injection – 2020-07-04 – 3 HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion #1043360 Valid Denial of Service – 2021-03-15 – 3 Node 18 reads openssl.cnf from /home/iojs/build/... upon startup on MacOS #1695596 Valid Cryptography – 2022-10-26 – 3 Regular Expression Denial of Service in Headers #1784449 Valid Denial of Service – 2023-03-19 – 3 Denial of Service: nghttp2 use of uninitialized pointer #335608 Valid Memory Corruption – 2020-02-13 – 4 `fs.realpath.native` on darwin may cause buffer overflow #965914 Valid Memory Corruption – 2020-10-17 – 4 Unexpected input validation of octal literals in nodejs v15.12.0 and below returns defined values for all undefined octal literals. #1141623 N/A Memory Corruption – 2021-06-14 – 4 Improper handling of untypical characters in domain names #1178337 Valid Memory Corruption – 2021-09-10 – 4 Undici does not use CONNECT or otherwise validate upstream HTTPS certificates when using a proxy #1583680 Valid Cryptography – 2022-07-13 – 4 Insecure loading of ICU data through ICU_DATA environment variable #1625036 Valid No weakness recorded – 2023-03-19 – 4 DNS rebinding in --inspect via invalid octal IP address #1710652 Valid Command and Code Injection – 2022-12-07 – 4 OpenSSL engines can be used to bypass and/or disable the permission model #1954535 Valid Access Control – 2023-06-22 – 4 Permission Model bypass via FileHandle.utimes() in the promises API #3625987 Valid Access Control Low 2026-06-25 – 4 Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings #3656716 Valid Access Control Medium 2026-06-25 – 4 Unbounded memory growth in `node:http2` clients via attacker-controlled ORIGIN frames #3676863 Valid Denial of Service Medium 2026-06-25 – 4 Proxy credentials leaked in ERR_PROXY_TUNNEL error message #3720313 Valid Information Disclosure Medium 2026-06-25 – 4 Pull Request #12949 - Security Implications without CVE assignment #415329 Valid Command and Code Injection – 2020-02-13 – 5 DNS rebinding in --inspect (insufficient fix of CVE-2018-7160) #1069487 Valid Access Control – 2021-02-23 $500 5 OOB read in libuv #1209681 Valid Memory Corruption – 2021-07-05 – 5 CVE-2022-32213 bypass via obs-fold mechanic #1630336 Valid Injection and Smuggling – 2022-10-26 – 5 Multiple OpenSSL error handling issues in nodejs crypto library #1808596 Valid Cryptography – 2023-02-17 – 5 Filesystem experimental permissions policy does not handle path traversal cases. #1952978 Valid File and Path Handling – 2023-07-20 – 5 fs module's file watching is not restricted by --allow-fs-read #1966499 Valid Access Control – 2023-07-20 – 5 TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections #3649802 Valid Other weaknesses Medium 2026-06-25 – 5 HTTP/2 Denial of Service Vulnerability #335533 Valid Memory Corruption – 2020-02-13 – 6 HTTP Request Smuggling Due to Incorrect Parsing of Multi-line Transfer-Encoding (improper fix for CVE-2022-32215) #1665156 Valid Injection and Smuggling – 2022-10-26 – 6 HTTP Request Smuggling Due to Incorrect Parsing of Header Fields #1675191 Valid Injection and Smuggling – 2022-10-26 – 6 Process-based permissions can be bypassed with the "inspector" module. #1962701 Valid Access Control – 2023-07-20 – 6 fs.openAsBlob() bypasses permission system #1966492 Valid Access Control – 2023-07-20 – 6 Permission Model filesystem over-grant via wildcard radix lookup #3996423 Valid Access Control Low 2026-10-27 – 6 napi_get_value_string_X allow various kinds of memory corruption #784186 Valid Memory Corruption – 2020-07-02 $250 7 HTTP Request Smuggling due to ignoring chunk extensions #1238099 Valid Injection and Smuggling – 2021-11-02 $250 7 HTTP Request Smuggling Due to Incorrect Parsing of Multi-line Transfer-Encoding #1501679 Valid Injection and Smuggling – 2022-07-07 – 7 HTTP Request Smuggling Due to Flawed Parsing of Transfer-Encoding #1524555 Valid Injection and Smuggling – 2022-07-07 – 7 Permissions policies can be bypassed via process.mainModule #1747642 Valid Access Control – 2023-03-19 – 7 DiffieHellman doesn't generate keys after setting a key #1927480 Valid Other weaknesses – 2023-07-20 – 7 CVE-2024-36137 Patch Bypass - FileHandle.chmod/chown #3449392 Valid Access Control Low 2026-03-30 – 7 Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion #3531737 Valid Denial of Service Medium 2026-03-30 – 7 Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching #3656869 Valid Access Control Medium 2026-06-25 – 7