PatchTheCVEnode.js vulnerabilities and fixes
Recent CVEs affecting node.js, with upgrade or downgrade steps. 5 tracked.
Also searched as: node js, nodejs.
node.js has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-07-30. Highest priority: CVE-2023-23919 (score 57/100).
- CVE-2023-23919 HIGH 7.5 UPGRADE A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did d
- CVE-2023-23918 HIGH 7.5 UPGRADE A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it p
- CVE-2026-58043 HIGH 8.4 UPGRADE A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix bound
- CVE-2026-56847 MEDIUM 6.1 UPGRADE A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Log
- CVE-2026-56850 MEDIUM 4.4 UPGRADE A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS
FAQ
How do I fix node.js vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is node.js being exploited right now?
None of the tracked node.js CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which node.js CVE should I patch first?
CVE-2023-23919 currently ranks highest (57/100): A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did d.