Known Vulnerabilities for products from Nodejs
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Nodejs".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-92952 json | Not Provided | 2026-09-17 | 2026-09-17 | |
| CVE-2026-85152 json | undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interc... | Not Provided | 2026-09-04 | 2026-09-16 |
| CVE-2026-85024 json | undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib in... | Not Provided | 2026-09-04 | 2026-09-16 |
| CVE-2026-85014 json | undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection w... | Not Provided | 2026-09-04 | 2026-09-15 |
| CVE-2026-85008 json | undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtra... | Not Provided | 2026-09-04 | 2026-09-15 |
| CVE-2026-84961 json | undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparse... | Not Provided | 2026-09-04 | 2026-09-15 |
| CVE-2026-84947 json | undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Co... | Not Provided | 2026-09-04 | 2026-09-15 |
| CVE-2026-84933 json | undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses t... | Not Provided | 2026-09-04 | 2026-09-15 |
| CVE-2026-84890 json | undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the nu... | Not Provided | 2026-09-04 | 2026-09-11 |
| CVE-2026-58043 json | A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under... | Not Provided | 2026-07-30 | 2026-08-25 |
| CVE-2026-56850 json | A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client i... | Not Provided | 2026-07-30 | 2026-08-25 |
| CVE-2026-56847 json | A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--al... | Not Provided | 2026-07-30 | 2026-08-25 |
| CVE-2026-48937 json | A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulner... | Not Provided | 2026-06-18 | 2026-08-18 |
| CVE-2026-48936 json | A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow... | Not Provided | 2026-06-26 | 2026-06-26 |
| CVE-2026-48935 json | A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. ... | Not Provided | 2026-06-26 | 2026-06-26 |
| CVE-2026-48934 json | A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affec... | Not Provided | 2026-06-26 | 2026-06-29 |
| CVE-2026-48933 json | A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. ... | Not Provided | 2026-06-26 | 2026-08-10 |
| CVE-2026-48931 json | A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the req... | Not Provided | 2026-06-22 | 2026-07-03 |
| CVE-2026-48930 json | A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-stri... | Not Provided | 2026-06-26 | 2026-06-26 |
| CVE-2026-48928 json | A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerabil... | Not Provided | 2026-06-26 | 2026-06-26 |