Permission Model bypass via FileHandle.utimes() in the promises API #3625987 Valid Access Control Low 2026-06-25 – 4 Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings #3656716 Valid Access Control Medium 2026-06-25 – 4 Unbounded memory growth in `node:http2` clients via attacker-controlled ORIGIN frames #3676863 Valid Denial of Service Medium 2026-06-25 – 4 Proxy credentials leaked in ERR_PROXY_TUNNEL error message #3720313 Valid Information Disclosure Medium 2026-06-25 – 4 TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections #3649802 Valid Other weaknesses Medium 2026-06-25 – 5 Permission Model filesystem over-grant via wildcard radix lookup #3996423 Valid Access Control Low 2026-10-27 – 6 CVE-2024-36137 Patch Bypass - FileHandle.chmod/chown #3449392 Valid Access Control Low 2026-03-30 – 7 Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion #3531737 Valid Denial of Service Medium 2026-03-30 – 7 Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching #3656869 Valid Access Control Medium 2026-06-25 – 7 Unix domain socket server bypasses --permission network restrictions (incomplete CVE-2026-21636 fix) #3618831 Valid Access Control Low 2026-06-25 – 8 Node.js Permission Model bypass: UDS server bind/listen works without `--allow-net` #3559715 Valid Access Control Medium 2026-03-30 – 10 HTTP Response Queue Poisoning via TOCTOU Race Condition in `http.Agent` #3582376 Valid Race Conditions Low 2026-06-25 – 11 node:sqlite SQLTagStore Iterator Replay Lets Attacker Re-Execute Victim-Bound Writes Indefinitely #3795900 Valid Race Conditions Medium 2026-08-28 – 11 dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records #3795657 Valid Denial of Service Medium 2026-08-28 – 12 HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion #3846922 Valid Denial of Service High 2026-08-28 – 12 Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected) #3857258 Valid Denial of Service Medium 2026-08-28 – 12 Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (DoS) #3760016 Valid Memory Corruption High 2026-06-25 – 13 Node --run POSIX positional argument escaping allows shell command injection #3817602 Informative Command and Code Injection High 2026-06-23 – 13 Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints #3962304 Valid Cryptography Medium 2026-10-23 – 13 Permission Model Bypass in realpathSync.native Allows File Existence Disclosure #3480841 Valid Information Disclosure Low 2026-03-30 – 15 Permission Model bypass with fs.realpathSync #3838675 Valid Access Control Low 2026-10-23 – 15 Keep-alive socket process a response that was written before the request was sent #4038361 Valid Race Conditions Medium 2026-10-23 – 15 Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery #3533945 Valid Cryptography Medium 2026-03-30 – 16 HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP Parser #3564941 Valid Injection and Smuggling Low 2026-08-28 – 16 Re-entrant `nghttp2_session_mem_send()` during `nghttp2_session_mem_recv()` causes heap-use-after-free in Node.js HTTP/2 #3833629 Valid Memory Corruption High 2026-08-28 – 17 Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat #3688064 Valid Injection and Smuggling High 2026-06-25 – 18 dns.resolve truncates names containing NUL char #4038342 Valid Access Control High 2026-10-23 – 18 HashDoS in V8 #3511792 Valid Cryptography Medium 2026-03-30 – 19 Permission Model Bypass: `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write` #3838601 Valid Access Control Low 2026-07-29 – 21 Denial of Service via `__proto__` header name in `req.headersDistinct` (Uncaught `TypeError` crashes Node.js process) #3560402 Valid Denial of Service High 2026-03-30 – 22 Null Dereference in X509ToObject #3824331 Valid Memory Corruption Medium 2026-10-23 – 22 HTTPS Agent PFX object-array key collision allows mTLS client identity reuse across different per-request certificates #3816840 Valid Authentication Medium 2026-07-29 – 24 TLS certificate hostname bypass when the host loosely resolves to an IP address #4006744 Valid Cryptography High 2026-10-23 – 24 Unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion #3456148 Valid No weakness recorded – 2026-02-23 – 25 Permission Model Bypass via `process.report.writeReport()` Path Misvalidation #3692858 Valid Access Control Low 2026-06-18 – 29 TLS certificate hostname bypass when the IP is written fullwidth digits #4038287 Valid Cryptography High 2026-10-23 – 29 Improper Input Validation — HTTP Response Parser Unconditionally Accepts Bare CR in Status Line #3648681 Valid Injection and Smuggling Medium 2026-07-01 – 30 Memory Corruption via TOCTOU Race in SharedArrayBuffer UTF-8 Decode (`StringBytes::Encode`) #3752489 Informative Race Conditions High 2026-05-23 – 32 HTTP/2 sessions never clean up after GOAWAY on invalid protocol errors #3658225 Valid Denial of Service Medium 2026-06-18 – 33 Permission Model: --allow-fs-read/--allow-fs-write radix-tree prefix-boundary over-grant #3761342 Valid Access Control High 2026-07-29 – 33 Memory leak that enables remote Denial of Service against applications processing TLS client certificates #3357723 Valid Denial of Service Medium 2026-02-12 – 34 fs.futimes() Bypasses Read-Only Permission Model #3390084 Valid Access Control Low 2026-01-15 – 34 FS Permissions Bypass #3417819 Valid Misconfiguration and Insecure Design High 2026-02-12 – 34 Uncatchable "Maximum call stack size exceeded" error on Node.js via async_hooks leads to process crashes bypassing error handlers #3456295 Valid Input Validation and Logic Medium 2026-02-12 – 35 Permission Model bypass: process.report writes (and overwrites) files outside --allow-fs-write paths #3815767 Valid Access Control Low 2026-07-30 – 35 HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934) #3812439 Valid Other weaknesses Medium 2026-07-30 – 37 Assertion error in node_url.cc via malformed URL format leads to Node.js crash #3546390 Valid Denial of Service Medium 2026-03-26 – 40 Incomplete Fix for CVE-2026-21637: OCSPRequest and resumeSession Events Crash Node.js TLS Server via Unhandled Synchronous Exceptions #3781015 Informative Denial of Service High 2026-06-12 – 41 Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled #3405778 Valid Memory Corruption High 2026-02-12 – 43 NULL pointer dereference in node:sqlite DatabaseSync#applyChangeset() via malformed SQLite changeset #3736889 Informative Memory Corruption High 2026-05-23 – 44