CVEs published by Node.js

CVEs published by Node.js (CVE Numbering Authority). 18 tracked.

• CVE-2018-12115 HIGH 7.5 UPGRADE DOWNGRADE In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Nod
• CVE-2018-7167 HIGH 7.5 UPGRADE Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial
• CVE-2018-7166 HIGH 7.5 UPGRADE In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to retur
• CVE-2018-7164 HIGH 7.5 UPGRADE Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM
• CVE-2018-7162 HIGH 7.5 UPGRADE All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH
• CVE-2018-7161 HIGH 7.5 UPGRADE All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH
• CVE-2018-7160 HIGH 8.8 UPGRADE The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to pe
• CVE-2018-7159 MEDIUM 5.3 UPGRADE The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing inp
• CVE-2018-7158 HIGH 7.5 UPGRADE The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service
• CVE-2018-12123 MEDIUM 4.3 UPGRADE Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for
• CVE-2018-12122 HIGH 7.5 UPGRADE DOWNGRADE Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: A
• CVE-2018-12121 HIGH 7.5 UPGRADE MITIGATE Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP h
• CVE-2018-12120 HIGH 8.1 UPGRADE Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When th
• CVE-2018-12116 HIGH 7.5 UPGRADE DOWNGRADE Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced
• CVE-2019-5739 HIGH 7.5 UPGRADE MITIGATE Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and e
• CVE-2019-5737 HIGH 7.5 UPGRADE MITIGATE In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an at
• CVE-2017-15897 LOW 3.1 UPGRADE Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the
• CVE-2017-15896 CRITICAL 9.1 UPGRADE Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS han

← Back to latest CVEs