HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion #3846922 Valid Denial of Service High 2026-08-28 – 12 Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (DoS) #3760016 Valid Memory Corruption High 2026-06-25 – 13 Node --run POSIX positional argument escaping allows shell command injection #3817602 Informative Command and Code Injection High 2026-06-23 – 13 Re-entrant `nghttp2_session_mem_send()` during `nghttp2_session_mem_recv()` causes heap-use-after-free in Node.js HTTP/2 #3833629 Valid Memory Corruption High 2026-08-28 – 17 Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat #3688064 Valid Injection and Smuggling High 2026-06-25 – 18 dns.resolve truncates names containing NUL char #4038342 Valid Access Control High 2026-10-23 – 18 Bypass incomplete fix of CVE-2024-27980 #2461831 Valid Command and Code Injection High 2024-07-09 – 20 Denial of Service via `__proto__` header name in `req.headersDistinct` (Uncaught `TypeError` crashes Node.js process) #3560402 Valid Denial of Service High 2026-03-30 – 22 Missing AES-GCM Authentication Tag Validation and Improper Deprecation Handling #3463949 Informative Cryptography High 2025-12-19 – 24 TLS certificate hostname bypass when the host loosely resolves to an IP address #4006744 Valid Cryptography High 2026-10-23 – 24 TLS certificate hostname bypass when the IP is written fullwidth digits #4038287 Valid Cryptography High 2026-10-23 – 29 Memory Corruption via TOCTOU Race in SharedArrayBuffer UTF-8 Decode (`StringBytes::Encode`) #3752489 Informative Race Conditions High 2026-05-23 – 32 Permission Model: --allow-fs-read/--allow-fs-write radix-tree prefix-boundary over-grant #3761342 Valid Access Control High 2026-07-29 – 33 FS Permissions Bypass #3417819 Valid Misconfiguration and Insecure Design High 2026-02-12 – 34 Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize() #3160912 Valid File and Path Handling High 2025-07-15 – 35 Improper error handling in async cryptographic operations crashes process #2817648 Valid Cryptography High 2025-05-14 – 37 Windows Device Names Still Allow Path Traversal in UNC Paths After CVE-2025-27210 Fix #3255707 Informative File and Path Handling High 2025-07-28 – 39 Incomplete Fix for CVE-2026-21637: OCSPRequest and resumeSession Events Crash Node.js TLS Server via Unhandled Synchronous Exceptions #3781015 Informative Denial of Service High 2026-06-12 – 41 Worker permission bypass via InternalWorker leak in diagnostics #2575105 Valid Access Control High 2025-01-21 – 42 Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled #3405778 Valid Memory Corruption High 2026-02-12 – 43 NULL pointer dereference in node:sqlite DatabaseSync#applyChangeset() via malformed SQLite changeset #3736889 Informative Memory Corruption High 2026-05-23 – 44 HashDoS in V8 #3131758 Valid Cryptography High 2025-07-15 – 53 Incomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoS #3556769 Valid No weakness recorded High 2026-04-23 – 59