PatchTheCVEnetsurf vulnerabilities and fixes
Recent CVEs affecting netsurf, with upgrade or downgrade steps. 3 tracked.
netsurf has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2025-11-03. Highest priority: CVE-2024-51317 (score 42/100).
- CVE-2025-45663 MEDIUM 6.5 DOWNGRADE An issue in NetSurf v3.11 causes the application to read uninitialized heap memory when creating a dom_event s
- CVE-2025-29699 MEDIUM 6.5 DOWNGRADE NetSurf 3.11 is vulnerable to Use After Free in dom_node_set_text_content function.
- CVE-2024-51317 MEDIUM 6.5 DOWNGRADE An issue in NetSurf v.3.11 allows a remote attacker to execute arbitrary code via the dom_node_normalize funct
FAQ
How do I fix netsurf vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is netsurf being exploited right now?
None of the tracked netsurf CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which netsurf CVE should I patch first?
CVE-2024-51317 currently ranks highest (42/100): An issue in NetSurf v.3.11 allows a remote attacker to execute arbitrary code via the dom_node_normalize funct.