PatchTheCVEnodejs vulnerabilities
Recent CVEs affecting nodejs products. 3 tracked.
nodejs has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2026-07-30. Highest priority: CVE-2026-58043 (score 30/100).
- CVE-2026-58043 HIGH 8.4 UPGRADE A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix bound
- CVE-2026-56847 MEDIUM 6.1 UPGRADE A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Log
- CVE-2026-56850 MEDIUM 4.4 UPGRADE A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS
FAQ
How do I fix nodejs vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is nodejs being exploited right now?
None of the tracked nodejs CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which nodejs CVE should I patch first?
CVE-2026-58043 currently ranks highest (30/100): A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix bound.