Skip to content
Sign in

nodejs product

node

Alert
No node CVE is in the CISA KEV catalogue.

Tracked since 18 Jun · latest article 21 Oct · RSS · API

0Open KEV deadlines

None open

0Added to KEV · 90 days

of 0 in the full CISA catalogue · all time

0High exploit odds · current

EPSS top 5%, not in KEV

0Articles · 7 days

none this week

Exploited, by due date

No node CVE is in the CISA KEV catalogue.

Patch cadence and exploit odds

How often CISA adds node CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

CISA has not added a node CVE to KEV.

Fix listed

2 of 12 CVEs in coverage

10 CVEs have no vendor fix recorded yet.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV.

top 5%CVE-2026-48933: 89.8th percentileCVE-2026-48618: 87.9th percentileCVE-2026-48619: 50.6th percentileCVE-2026-56848: 44.2th percentileCVE-2026-56846: 42.8th percentileCVE-2026-105482: 40.5th percentileCVE-2026-48615: 34.6th percentileCVE-2026-48617: 24.6th percentileCVE-2026-48930: 24.4th percentileCVE-2026-106069: 23.2th percentileCVE-2026-105483: 23.2th percentileCVE-2026-58043: 3.2th percentile050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2026-4893389.8
CVE-2026-4861887.9
CVE-2026-4861950.6
CVE-2026-5684844.2
CVE-2026-5684642.8
CVE-2026-10548240.5
CVE-2026-4861534.6
CVE-2026-4861724.6
CVE-2026-4893024.4
CVE-2026-10606923.2
CVE-2026-10548323.2
CVE-2026-580433.2

Coverage3 articles · all time

The latest 3 articles naming node, in the shared story grammar.

Full timeline
Quiet for 12 dayslast report 21 Oct3 articles2 outlets

3 articles from 2 outlets since 18 Jun. Quiet since 21 Oct.

Now18 Jun7 Oct10131619222528First reportSecurityOnline · 18 Jun, 19:02Exploited CVESecurityOnline · 21 OctPicked up againafter 16 weeks quiet
  • Thu 18 Jun, 19:02 UTC. SecurityOnline, first report. Node.js fixes critical WebCrypto TLS flaws in urgent update.
  • Wed 7 Oct, 17:30 UTC. Microsoft, its first report on the story. Microsoft’s AI Research Uncovered 140 Windows Vulnerabilities and Spurred Linux Fixes.
  • Wed 21 Oct, 17:54 UTC. SecurityOnline. Node.js fixes Brotli flaw that could enable remote code execution. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 3 articles as a list
  1. Thu 18 JunDay 01
    1. Node.js fixes critical WebCrypto TLS flaws in urgent update19:02 · SecurityOnline · First report

  2. Quiet for 16 weeks

    Wed 7 OctDay 1111
    1. Microsoft’s AI Research Uncovered 140 Windows Vulnerabilities and Spurred Linux Fixes17:30 · Microsoft · Picked up again

  3. Quiet for 2 weeks

    Wed 21 OctDay 1251
    1. Node.js fixes Brotli flaw that could enable remote code execution17:54 · SecurityOnline · Exploited CVE · Picked up again · Known exploited CVE

All CVEs in coverage12

Exploited first, then by EPSS

In the CVE tracker
CyberSIXTSignal over noise
Updated AboutDevelopersSign in