Improper HTTP header block termination in llhttp #2054283 Valid Injection and Smuggling Medium 2025-06-13 – 122 TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD Leak #3473882 Valid Denial of Service Medium 2026-02-12 – 81 Path traversal by drive name in Windows environment #2307225 Valid File and Path Handling Medium 2025-01-27 – 59 Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS) #3465156 Valid Server-Side Request Forgery Medium 2026-02-12 – 52 HTTP Request Smuggling via Connection: close<TAB> in Node.js llhttp parser #3723248 Valid Injection and Smuggling Medium 2026-07-31 – 49 WASI sandbox escape via symlink #2084280 Valid Access Control Medium 2025-05-24 – 44 Assertion error in node_url.cc via malformed URL format leads to Node.js crash #3546390 Valid Denial of Service Medium 2026-03-26 – 40 HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934) #3812439 Valid Other weaknesses Medium 2026-07-30 – 37 Uncatchable "Maximum call stack size exceeded" error on Node.js via async_hooks leads to process crashes bypassing error handlers #3456295 Valid Input Validation and Logic Medium 2026-02-12 – 35 Memory leak that enables remote Denial of Service against applications processing TLS client certificates #3357723 Valid Denial of Service Medium 2026-02-12 – 34 HTTP/2 sessions never clean up after GOAWAY on invalid protocol errors #3658225 Valid Denial of Service Medium 2026-06-18 – 33 Improper Input Validation — HTTP Response Parser Unconditionally Accepts Bare CR in Status Line #3648681 Valid Injection and Smuggling Medium 2026-07-01 – 30 HTTPS Agent PFX object-array key collision allows mTLS client identity reuse across different per-request certificates #3816840 Valid Authentication Medium 2026-07-29 – 24 Usage of unsafe random function in undici for choosing boundary #2913312 Valid Cryptography Medium 2025-01-23 – 24 Null Dereference in X509ToObject #3824331 Valid Memory Corruption Medium 2026-10-23 – 22 HashDoS in V8 #3511792 Valid Cryptography Medium 2026-03-30 – 19 Bypass network import restriction via data URL #2092749 Valid Access Control Medium 2024-07-08 – 18 Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery #3533945 Valid Cryptography Medium 2026-03-30 – 16 Keep-alive socket process a response that was written before the request was sent #4038361 Valid Race Conditions Medium 2026-10-23 – 15 Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints #3962304 Valid Cryptography Medium 2026-10-23 – 13 GOAWAY HTTP/2 frames cause memory leak outside heap #2841362 Valid Denial of Service Medium 2025-02-06 – 13 Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected) #3857258 Valid Denial of Service Medium 2026-08-28 – 12 dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records #3795657 Valid Denial of Service Medium 2026-08-28 – 12 node:sqlite SQLTagStore Iterator Replay Lets Attacker Re-Execute Victim-Bound Writes Indefinitely #3795900 Valid Race Conditions Medium 2026-08-28 – 11 Node.js Permission Model bypass: UDS server bind/listen works without `--allow-net` #3559715 Valid Access Control Medium 2026-03-30 – 10 Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching #3656869 Valid Access Control Medium 2026-06-25 – 7 Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion #3531737 Valid Denial of Service Medium 2026-03-30 – 7 TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections #3649802 Valid Other weaknesses Medium 2026-06-25 – 5 Proxy credentials leaked in ERR_PROXY_TUNNEL error message #3720313 Valid Information Disclosure Medium 2026-06-25 – 4 Unbounded memory growth in `node:http2` clients via attacker-controlled ORIGIN frames #3676863 Valid Denial of Service Medium 2026-06-25 – 4 Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings #3656716 Valid Access Control Medium 2026-06-25 – 4