Vulnerability in http-parser & embedded NULL header handling #536954 Valid Memory Corruption – 2020-02-13 – 1 Http response is not ended although underlying socket is already destroyed #676710 Informative Denial of Service – 2020-01-15 – 1 Use After Free in crypto.randomFill #340053 Informative Memory Corruption – 2020-01-15 – 2 Node.js HTTP/2 Large Settings Frame DoS #446662 Valid Denial of Service – 2020-07-02 – 2 CRLF Injection in legacy url API (url.parse().hostname) #771596 Informative Injection and Smuggling – 2020-01-10 – 2 DNS Max Responses for DOS #1033107 Valid Denial of Service – 2020-12-16 $250 2 Out of order TLS handshake / application data messages lead to segmentation fault #335495 Valid Memory Corruption – 2020-02-13 – 3 Fix for CVE-2018-12122 can be bypassed via keep-alive requests #453513 Valid Denial of Service – 2020-02-13 – 3 loader.js is not secure #629879 N/A Command and Code Injection – 2020-06-11 – 3 Hostname spoofing #678487 Informative No weakness recorded – 2020-01-10 – 3 Child process environment injection via prototype pollution #878181 Informative Command and Code Injection – 2020-07-04 – 3 Denial of Service: nghttp2 use of uninitialized pointer #335608 Valid Memory Corruption – 2020-02-13 – 4 `fs.realpath.native` on darwin may cause buffer overflow #965914 Valid Memory Corruption – 2020-10-17 – 4 Pull Request #12949 - Security Implications without CVE assignment #415329 Valid Command and Code Injection – 2020-02-13 – 5 HTTP/2 Denial of Service Vulnerability #335533 Valid Memory Corruption – 2020-02-13 – 6 napi_get_value_string_X allow various kinds of memory corruption #784186 Valid Memory Corruption – 2020-07-02 $250 7 Slowloris, body parsing #799072 Valid Denial of Service – 2020-10-17 $250 8 Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests #868834 Valid Denial of Service – 2020-10-17 $250 8 url.parse() hostname spoofing via javascript: URIs #395845 Valid Cross-site Scripting – 2020-01-15 – 11 HTTP header values do not have trailing OWS trimmed #730779 Valid Input Validation and Logic – 2020-02-24 – 11 Malformed HTTP/2 SETTINGS frame leads to reachable assert #800140 Valid Denial of Service – 2020-07-03 $250 14 Remotely trigger an assertion on a TLS server with a malformed certificate string #746733 Valid Cryptography – 2020-02-06 – 15 Node.js: TLS session reuse can lead to hostname verification bypass #811502 Valid Cryptography – 2020-06-03 – 29 Http request splitting #409943 Valid Injection and Smuggling – 2020-01-15 – 45 HTTP request smuggling using malformed Transfer-Encoding header #735748 Valid Injection and Smuggling – 2020-03-07 – 105 HTTP Request Smuggling due to CR-to-Hyphen conversion #922597 Valid Injection and Smuggling – 2020-10-17 – 134