Known Vulnerabilities for products from NodeJS
Listed below are 20 of the newest known vulnerabilities associated with the vendor "NodeJS".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-110644 json | Not Provided | 2026-10-14 | 2026-10-14 | |
| CVE-2026-109932 json | undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12... | Not Provided | 2026-10-15 | 2026-10-19 |
| CVE-2026-109924 json | undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.... | Not Provided | 2026-10-15 | 2026-10-19 |
| CVE-2026-109869 json | undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.1... | Not Provided | 2026-10-15 | 2026-10-19 |
| CVE-2026-109855 json | undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enab... | Not Provided | 2026-10-15 | 2026-10-19 |
| CVE-2026-109841 json | undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() impleme... | Not Provided | 2026-10-15 | 2026-10-19 |
| CVE-2026-109829 json | undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless A... | Not Provided | 2026-10-15 | 2026-10-19 |
| CVE-2026-109383 json | undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.... | Not Provided | 2026-10-15 | 2026-10-19 |
| CVE-2026-96294 json | Not Provided | 2026-10-02 | 2026-10-02 | |
| CVE-2026-94646 json | Not Provided | 2026-10-02 | 2026-10-02 | |
| CVE-2026-94645 json | Not Provided | 2026-10-02 | 2026-10-05 | |
| CVE-2026-92952 json | Not Provided | 2026-09-17 | 2026-09-17 | |
| CVE-2026-87029 json | undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress inte... | Not Provided | 2026-10-15 | 2026-10-19 |
| CVE-2026-87018 json | undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.... | Not Provided | 2026-10-15 | 2026-10-19 |
| CVE-2026-86535 json | Not Provided | 2026-10-02 | 2026-10-02 | |
| CVE-2026-85152 json | undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interc... | Not Provided | 2026-09-04 | 2026-09-16 |
| CVE-2026-85024 json | undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib in... | Not Provided | 2026-09-04 | 2026-09-16 |
| CVE-2026-85014 json | undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection w... | Not Provided | 2026-09-04 | 2026-09-15 |
| CVE-2026-85008 json | undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtra... | Not Provided | 2026-09-04 | 2026-09-15 |
| CVE-2026-84961 json | undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparse... | Not Provided | 2026-09-04 | 2026-09-15 |