"Assertion failed" in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash #2319584 Valid Denial of Service High 2024-04-08 – 65 Incomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoS #3556769 Valid No weakness recorded High 2026-04-23 – 59 HashDoS in V8 #3131758 Valid Cryptography High 2025-07-15 – 53 Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled #3405778 Valid Memory Corruption High 2026-02-12 – 43 Worker permission bypass via InternalWorker leak in diagnostics #2575105 Valid Access Control High 2025-01-21 – 42 Improper error handling in async cryptographic operations crashes process #2817648 Valid Cryptography High 2025-05-14 – 37 Path traversal by monkey-patching Buffer internals #2218653 Valid File and Path Handling High 2024-02-15 – 36 Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize() #3160912 Valid File and Path Handling High 2025-07-15 – 35 FS Permissions Bypass #3417819 Valid Misconfiguration and Insecure Design High 2026-02-12 – 34 Permission Model: --allow-fs-read/--allow-fs-write radix-tree prefix-boundary over-grant #3761342 Valid Access Control High 2026-07-29 – 33 TLS certificate hostname bypass when the IP is written fullwidth digits #4038287 Valid Cryptography High 2026-10-23 – 29 TLS certificate hostname bypass when the host loosely resolves to an IP address #4006744 Valid Cryptography High 2026-10-23 – 24 setuid() does not drop all privileges due to io_uring #2170226 Valid Access Control High 2024-03-16 – 24 Code injection and privilege escalation through Linux capabilities #2237545 Valid Access Control High 2024-02-15 – 23 Denial of Service via `__proto__` header name in `req.headersDistinct` (Uncaught `TypeError` crashes Node.js process) #3560402 Valid Denial of Service High 2026-03-30 – 22 Bypass incomplete fix of CVE-2024-27980 #2461831 Valid Command and Code Injection High 2024-07-09 – 20 Multiple permission model bypasses due to improper path traversal sequence sanitization #2259914 Valid File and Path Handling High 2024-02-15 – 20 dns.resolve truncates names containing NUL char #4038342 Valid Access Control High 2026-10-23 – 18 Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat #3688064 Valid Injection and Smuggling High 2026-06-25 – 18 Re-entrant `nghttp2_session_mem_send()` during `nghttp2_session_mem_recv()` causes heap-use-after-free in Node.js HTTP/2 #3833629 Valid Memory Corruption High 2026-08-28 – 17 DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices) #1632921 Valid Access Control High 2022-09-28 – 16 Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (DoS) #3760016 Valid Memory Corruption High 2026-06-25 – 13 http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks #2233486 Valid Denial of Service High 2024-02-15 – 13 HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion #3846922 Valid Denial of Service High 2026-08-28 – 12 Weak randomness in WebCrypto keygen #1690000 Valid Cryptography High 2022-10-26 – 11 The use of __proto__ in process.mainModule.__proto__.require() bypasses the permission system in Node v19.6.1 #1877919 Valid Access Control High 2023-07-20 – 8 Permissions policies can be bypassed via process.mainModule #1747642 Valid Access Control High 2023-03-19 – 7 Process-based permissions can be bypassed with the "inspector" module. #1962701 Valid Access Control High 2023-07-20 – 6 Filesystem experimental permissions policy does not handle path traversal cases. #1952978 Valid File and Path Handling High 2023-07-20 – 5 Undici does not use CONNECT or otherwise validate upstream HTTPS certificates when using a proxy #1583680 Valid Cryptography High 2022-07-13 – 4