Node.js vulnerabilities and fixes

CVEs that mention Node.js, ranked by priority. 80 tracked.

Node.js has 80 tracked vulnerabilities, 7 critical. A fixed release or vendor patch exists for 44. Most recent: 2026-10-23. Highest priority: CVE-2026-73299 (score 63/100).

• CVE-2026-73299 CRITICAL 10.0 Prompty is a markdown file format (.prompty) for LLM prompts
• CVE-2026-53975 CRITICAL 9.8 OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attacker
• CVE-2026-69264 CRITICAL 9.8 UPGRADE Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly
• CVE-2023-23919 HIGH 7.5 UPGRADE A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did d
• CVE-2026-47698 CRITICAL 9.8 vm2 is an open source vm/sandbox for Node.js
• CVE-2026-47683 HIGH 8.7 vm2 is an open source vm/sandbox for Node.js
• CVE-2026-55968 HIGH 7.5 UPGRADE Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apac
• CVE-2023-23918 HIGH 7.5 UPGRADE A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it p
• CVE-2026-54722 HIGH 8.7 DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks
• CVE-2026-54729 HIGH 8.7 DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks
• CVE-2026-73567 CRITICAL 9.1 sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4
• CVE-2026-66395 CRITICAL 9.6 SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin read
• CVE-2026-55100 HIGH 8.7 hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API
• CVE-2026-75915 HIGH 7.5 CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution to
• CVE-2026-47686 CRITICAL 9.9 vm2 is an open source vm/sandbox for Node.js
• CVE-2026-73561 HIGH 7.5 Hub is a Node.js WebSocket server and client with added features
• CVE-2026-113658 HIGH 7.5 ApostropheCMS is an open-source Node.js content management system
• CVE-2026-73566 HIGH 7.5 node-tar is a tar archive manipulation library for Node.js
• CVE-2026-111756 HIGH 8.2 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects
• CVE-2026-66396 HIGH 8.4 SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and
• CVE-2026-105482 HIGH 7.4 A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.re
• CVE-2026-114142 HIGH 8.8 toml-node is a TOML parser for Node.js and the browser
• CVE-2026-56846 HIGH 7.5 A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable re
• CVE-2026-56848 HIGH 7.5 A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2
• CVE-2026-113872 HIGH 7.5 multer is a middleware for Node.js that handles multipart/form-data file uploads
• CVE-2026-114141 HIGH 8.7 toml-node is a TOML parser for Node.js and the browser
• CVE-2026-114143 HIGH 8.7 toml-node is a TOML parser for Node.js and the browser
• CVE-2026-115570 HIGH 7.4 Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
• CVE-2026-71279 HIGH 8.0 Zigbee2MQTT's ExternalJSExtension.getFilePath (lib/extension/externalJS.ts) joins a parameter received via an
• CVE-2026-75926 HIGH 8.6 UPGRADE Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through
• CVE-2026-111181 HIGH 7.5 body-parser is body parsing middleware for Node.js and Express
• CVE-2026-114144 HIGH 7.5 toml-node is a TOML parser for Node.js and the browser
• CVE-2026-114102 HIGH 7.5 adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash
• CVE-2026-49857 HIGH 7.4 auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages
• CVE-2026-63667 MEDIUM 6.5 ApostropheCMS is an open-source Node.js content management system
• CVE-2026-73565 MEDIUM 5.3 @hono/node-server allows running the Hono application on Node.js
• CVE-2026-105483 HIGH 7.4 A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenti
• CVE-2026-106069 HIGH 7.4 A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different
• CVE-2026-71553 HIGH 7.1 ApostropheCMS is an open-source Node.js content management system
• CVE-2026-72749 MEDIUM 6.5 UPGRADE n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set)
• CVE-2026-58042 MEDIUM 5.9 A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than
• CVE-2026-14893 HIGH 7.3 IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @ins
• CVE-2026-66749 MEDIUM 6.5 Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers t
• CVE-2026-70593 MEDIUM 6.6 Ghost is a Node.js content management system
• CVE-2026-105481 MEDIUM 6.5 A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent b
• CVE-2026-64806 HIGH 8.4 UPGRADE In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via th
• CVE-2026-58043 HIGH 8.4 UPGRADE A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix bound
• CVE-2026-73231 HIGH 7.8 Faker generates massive amounts of fake data in the browser and Node.js
• CVE-2026-106072 MEDIUM 6.7 A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP end
• CVE-2026-112954 MEDIUM 5.3 ApostropheCMS is an open-source Node.js content management system
• CVE-2026-63669 MEDIUM 6.5 ApostropheCMS is an open-source Node.js content management system
• CVE-2026-69116 MEDIUM 6.1 FlyEnv before 4.18.0 fails to sanitize HTML from markdown rendering and AI chat content passed to Vue v-html d
• CVE-2026-70592 MEDIUM 5.5 Ghost is a Node.js content management system
• CVE-2026-113664 MEDIUM 5.3 ApostropheCMS is an open-source Node.js content management system
• CVE-2026-58040 MEDIUM 6.3 An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification ac
• CVE-2026-63670 MEDIUM 6.1 ApostropheCMS is an open-source Node.js content management system
• CVE-2026-70594 MEDIUM 6.7 Ghost is a Node.js content management system
• CVE-2026-106074 MEDIUM 4.8 A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUI
• CVE-2026-113649 MEDIUM 6.5 ApostropheCMS is an open-source Node.js content management system
• CVE-2026-70588 MEDIUM 5.0 Ghost is a Node.js content management system
• CVE-2026-70589 MEDIUM 4.8 Ghost is a Node.js content management system
• CVE-2026-113669 MEDIUM 5.3 ApostropheCMS is an open-source Node.js content management system
• CVE-2026-106070 LOW 3.7 A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entr
• CVE-2026-58041 MEDIUM 5.3 A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore
• CVE-2026-68499 MEDIUM 6.2 re2 provides Node.js bindings for Google's RE2 regular expression engine
• CVE-2026-70595 MEDIUM 4.0 Ghost is a Node.js content management system
• CVE-2026-58044 LOW 3.7 A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that
• CVE-2026-58045 MEDIUM 6.2 A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchrono
• CVE-2026-70590 MEDIUM 4.8 Ghost is a Node.js content management system
• CVE-2026-71430 MEDIUM 6.2 node-re2 provides RE2 regular expression bindings for Node.js
• CVE-2026-56847 MEDIUM 6.1 UPGRADE A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Log
• CVE-2026-70591 MEDIUM 4.1 Ghost is a Node.js content management system
• CVE-2026-67550 MEDIUM 5.7 re2 provides Node.js bindings for Google's RE2 regular expression engine
• CVE-2026-70596 MEDIUM 4.3 Ghost is a Node.js content management system
• CVE-2026-71498 MEDIUM 5.1 node-re2 provides RE2 regular expression bindings for Node.js
• CVE-2026-113648 LOW 3.1 ApostropheCMS is an open-source Node.js content management system
• CVE-2026-56850 MEDIUM 4.4 UPGRADE A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS
• CVE-2026-106071 LOW 3.6 A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildca
• CVE-2026-106073 LOW 3.3 A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read
• CVE-2026-58039 LOW 3.3 A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --a

FAQ

How do I fix Node.js vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Node.js being exploited right now?

None of the tracked Node.js CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Node.js CVE should I patch first?

CVE-2026-73299 currently ranks highest (63/100): Prompty is a markdown file format (.prompty) for LLM prompts.

← Back to latest CVEs