Built-in TLS module unexpectedly treats "rejectUnauthorized: undefined" as "rejectUnauthorized: false", disabling all certificate validation #1278254 Valid Cryptography – 2021-09-10 $150 20 HashDoS in V8 #3511792 Valid Cryptography Medium 2026-03-30 – 19 dns.resolve truncates names containing NUL char #4038342 Valid Access Control High 2026-10-23 – 18 Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat #3688064 Valid Injection and Smuggling High 2026-06-25 – 18 Proxy-Authorization header is not cleared in cross-domain redirect in undici #2352957 Valid Information Disclosure – 2024-03-12 – 18 HTTP Request Smuggling via Content Length Obfuscation #2237099 Valid Injection and Smuggling – 2024-05-03 – 18 fs.lstat bypasses permission model #2145862 Valid Access Control Low 2024-07-09 – 18 Bypass network import restriction via data URL #2092749 Valid Access Control Medium 2024-07-08 – 18 HTTP Request Smuggling due to accepting space before colon #1238709 Valid Injection and Smuggling – 2021-10-20 $250 18 Re-entrant `nghttp2_session_mem_send()` during `nghttp2_session_mem_recv()` causes heap-use-after-free in Node.js HTTP/2 #3833629 Valid Memory Corruption High 2026-08-28 – 17 HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP Parser #3564941 Valid Injection and Smuggling Low 2026-08-28 – 16 Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery #3533945 Valid Cryptography Medium 2026-03-30 – 16 Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) #2269177 Valid Cryptography – 2024-02-15 – 16 DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices) #1632921 Valid Access Control – 2022-09-28 – 16 Prototype pollution via console.table properties #1431042 Valid Other weaknesses – 2022-01-11 – 16 Keep-alive socket process a response that was written before the request was sent #4038361 Valid Race Conditions Medium 2026-10-23 – 15 Permission Model bypass with fs.realpathSync #3838675 Valid Access Control Low 2026-10-23 – 15 Permission Model Bypass in realpathSync.native Allows File Existence Disclosure #3480841 Valid Information Disclosure Low 2026-03-30 – 15 Remotely trigger an assertion on a TLS server with a malformed certificate string #746733 Valid Cryptography – 2020-02-06 – 15 Malformed HTTP/2 SETTINGS frame leads to reachable assert #800140 Valid Denial of Service – 2020-07-03 $250 14 Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints #3962304 Valid Cryptography Medium 2026-10-23 – 13 Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (DoS) #3760016 Valid Memory Corruption High 2026-06-25 – 13 GOAWAY HTTP/2 frames cause memory leak outside heap #2841362 Valid Denial of Service Medium 2025-02-06 – 13 http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks #2233486 Valid Denial of Service – 2024-02-15 – 13 Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected) #3857258 Valid Denial of Service Medium 2026-08-28 – 12 HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion #3846922 Valid Denial of Service High 2026-08-28 – 12 dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records #3795657 Valid Denial of Service Medium 2026-08-28 – 12 Off-by-slash vulnerability in nodejs.org and iojs.org #1631350 Valid File and Path Handling – 2022-08-24 – 12 node:sqlite SQLTagStore Iterator Replay Lets Attacker Re-Execute Victim-Bound Writes Indefinitely #3795900 Valid Race Conditions Medium 2026-08-28 – 11 HTTP Response Queue Poisoning via TOCTOU Race Condition in `http.Agent` #3582376 Valid Race Conditions Low 2026-06-25 – 11 fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect #2377760 Valid Misconfiguration and Insecure Design – 2024-05-03 – 11 CRLF Injection in Nodejs ‘undici’ via host #1820955 Valid Injection and Smuggling – 2023-02-22 – 11 Weak randomness in WebCrypto keygen #1690000 Valid Cryptography – 2022-10-26 – 11 HTTP header values do not have trailing OWS trimmed #730779 Valid Input Validation and Logic – 2020-02-24 – 11 url.parse() hostname spoofing via javascript: URIs #395845 Valid Cross-site Scripting – 2020-01-15 – 11 Node.js Permission Model bypass: UDS server bind/listen works without `--allow-net` #3559715 Valid Access Control Medium 2026-03-30 – 10 Node Installer Local Privilege Escalation #1211160 Valid Access Control – 2021-07-01 – 10 Proxy-Authorization header not cleared on cross-origin redirect in undici.request #2408074 Valid Authentication – 2024-05-03 – 9 HTTP Request Smuggling Due To Improper Delimiting of Header Fields #1524692 Valid Injection and Smuggling – 2022-07-07 – 9 Multiple HTTP/2 DOS Issues #589739 Valid Denial of Service – 2019-08-16 – 9 Unix domain socket server bypasses --permission network restrictions (incomplete CVE-2026-21636 fix) #3618831 Valid Access Control Low 2026-06-25 – 8 HTTP Request Smuggling via Empty headers separated by CR #2001873 Valid Injection and Smuggling – 2023-06-20 – 8 The use of __proto__ in process.mainModule.__proto__.require() bypasses the permission system in Node v19.6.1 #1877919 Valid Access Control – 2023-07-20 – 8 Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests #868834 Valid Denial of Service – 2020-10-17 $250 8 Slowloris, body parsing #799072 Valid Denial of Service – 2020-10-17 $250 8 Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching #3656869 Valid Access Control Medium 2026-06-25 – 7 Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion #3531737 Valid Denial of Service Medium 2026-03-30 – 7 CVE-2024-36137 Patch Bypass - FileHandle.chmod/chown #3449392 Valid Access Control Low 2026-03-30 – 7 DiffieHellman doesn't generate keys after setting a key #1927480 Valid Other weaknesses – 2023-07-20 – 7 Permissions policies can be bypassed via process.mainModule #1747642 Valid Access Control – 2023-03-19 – 7