Take over subdomain undici.nodejs.org.cdn.cloudflare.net #1763817 Valid Memory Corruption – 2023-01-11 – 22 Permission Model Bypass: `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write` #3838601 Valid Access Control Low 2026-07-29 – 21 fs.fchown/fchmod bypasses permission model #2472071 Valid Access Control Low 2024-07-09 – 20 Bypass incomplete fix of CVE-2024-27980 #2461831 Valid Command and Code Injection High 2024-07-09 – 20 Permissions can be bypassed via arbitrary code execution through abusing libuv signal pipes #2260337 Informative Access Control – 2024-08-08 – 20 Multiple permission model bypasses due to improper path traversal sequence sanitization #2259914 Valid File and Path Handling – 2024-02-15 – 20 Improper handling of wildcards in --allow-fs-read and --allow-fs-write #2257156 Valid Access Control – 2024-02-15 – 20 Built-in TLS module unexpectedly treats "rejectUnauthorized: undefined" as "rejectUnauthorized: false", disabling all certificate validation #1278254 Valid Cryptography – 2021-09-10 $150 20 HashDoS in V8 #3511792 Valid Cryptography Medium 2026-03-30 – 19 dns.resolve truncates names containing NUL char #4038342 Valid Access Control High 2026-10-23 – 18 Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat #3688064 Valid Injection and Smuggling High 2026-06-25 – 18 Proxy-Authorization header is not cleared in cross-domain redirect in undici #2352957 Valid Information Disclosure – 2024-03-12 – 18 HTTP Request Smuggling via Content Length Obfuscation #2237099 Valid Injection and Smuggling – 2024-05-03 – 18 fs.lstat bypasses permission model #2145862 Valid Access Control Low 2024-07-09 – 18 Bypass network import restriction via data URL #2092749 Valid Access Control Medium 2024-07-08 – 18 HTTP Request Smuggling due to accepting space before colon #1238709 Valid Injection and Smuggling – 2021-10-20 $250 18 Re-entrant `nghttp2_session_mem_send()` during `nghttp2_session_mem_recv()` causes heap-use-after-free in Node.js HTTP/2 #3833629 Valid Memory Corruption High 2026-08-28 – 17 HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP Parser #3564941 Valid Injection and Smuggling Low 2026-08-28 – 16 Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery #3533945 Valid Cryptography Medium 2026-03-30 – 16 Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) #2269177 Valid Cryptography – 2024-02-15 – 16 DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices) #1632921 Valid Access Control – 2022-09-28 – 16 Prototype pollution via console.table properties #1431042 Valid Other weaknesses – 2022-01-11 – 16 Keep-alive socket process a response that was written before the request was sent #4038361 Valid Race Conditions Medium 2026-10-23 – 15 Permission Model bypass with fs.realpathSync #3838675 Valid Access Control Low 2026-10-23 – 15 Permission Model Bypass in realpathSync.native Allows File Existence Disclosure #3480841 Valid Information Disclosure Low 2026-03-30 – 15 Remotely trigger an assertion on a TLS server with a malformed certificate string #746733 Valid Cryptography – 2020-02-06 – 15 Malformed HTTP/2 SETTINGS frame leads to reachable assert #800140 Valid Denial of Service – 2020-07-03 $250 14 Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints #3962304 Valid Cryptography Medium 2026-10-23 – 13 Node --run POSIX positional argument escaping allows shell command injection #3817602 Informative Command and Code Injection High 2026-06-23 – 13 Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (DoS) #3760016 Valid Memory Corruption High 2026-06-25 – 13 GOAWAY HTTP/2 frames cause memory leak outside heap #2841362 Valid Denial of Service Medium 2025-02-06 – 13 http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks #2233486 Valid Denial of Service – 2024-02-15 – 13 Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected) #3857258 Valid Denial of Service Medium 2026-08-28 – 12 HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion #3846922 Valid Denial of Service High 2026-08-28 – 12 dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records #3795657 Valid Denial of Service Medium 2026-08-28 – 12 Off-by-slash vulnerability in nodejs.org and iojs.org #1631350 Valid File and Path Handling – 2022-08-24 – 12 node:sqlite SQLTagStore Iterator Replay Lets Attacker Re-Execute Victim-Bound Writes Indefinitely #3795900 Valid Race Conditions Medium 2026-08-28 – 11 HTTP Response Queue Poisoning via TOCTOU Race Condition in `http.Agent` #3582376 Valid Race Conditions Low 2026-06-25 – 11 fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect #2377760 Valid Misconfiguration and Insecure Design – 2024-05-03 – 11 CRLF Injection in Nodejs ‘undici’ via host #1820955 Valid Injection and Smuggling – 2023-02-22 – 11 Weak randomness in WebCrypto keygen #1690000 Valid Cryptography – 2022-10-26 – 11 HTTP header values do not have trailing OWS trimmed #730779 Valid Input Validation and Logic – 2020-02-24 – 11 url.parse() hostname spoofing via javascript: URIs #395845 Valid Cross-site Scripting – 2020-01-15 – 11 Node.js Permission Model bypass: UDS server bind/listen works without `--allow-net` #3559715 Valid Access Control Medium 2026-03-30 – 10 Node Installer Local Privilege Escalation #1211160 Valid Access Control – 2021-07-01 – 10 Proxy-Authorization header not cleared on cross-origin redirect in undici.request #2408074 Valid Authentication – 2024-05-03 – 9 HTTP Request Smuggling Due To Improper Delimiting of Header Fields #1524692 Valid Injection and Smuggling – 2022-07-07 – 9 Multiple HTTP/2 DOS Issues #589739 Valid Denial of Service – 2019-08-16 – 9 Unix domain socket server bypasses --permission network restrictions (incomplete CVE-2026-21636 fix) #3618831 Valid Access Control Low 2026-06-25 – 8 HTTP Request Smuggling via Empty headers separated by CR #2001873 Valid Injection and Smuggling – 2023-06-20 – 8