Browse / Node.js

Node.js

See its reports on the map

What gets reported to Node.js

• Access Control33
• Denial of Service24
• Cryptography22
• Injection and Smuggling21
• Memory Corruption18
• Path Traversal7

Most upvoted reports

AllValidInformativeN/ADuplicate

1. HTTP Request Smuggling due to CR-to-Hyphen conversionHTTP Request Smuggling · high
   134 votes
2. Improper HTTP header block termination in llhttpHTTP Request Smuggling · medium
   122 votes
3. HTTP request smuggling using malformed Transfer-Encoding headerHTTP Request Smuggling · critical
   105 votes
4. TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD LeakUncontrolled Resource Consumption · medium
   81 votes
5. "Assertion failed" in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crashUncontrolled Resource Consumption · high
   65 votes
6. Incomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoSCryptographic Issues - Generic · high
   59 votes
7. Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string.Memory Corruption - Generic · low
   59 votes
8. Path traversal by drive name in Windows environmentPath Traversal · medium
   59 votes
9. CWE-195 in ExternalMemoryAccounter::Increase()Informative
   55 votes
10. HashDoS in V8Cryptographic Issues - Generic · high
    53 votes
11. Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS)Server-Side Request Forgery (SSRF) · medium
    52 votes
12. HTTP Request Smuggling via Connection: close<TAB> in Node.js llhttp parserHTTP Request Smuggling · medium
    49 votes
13. Http request splittingHTTP Response Splitting · medium
    45 votes
14. NULL pointer dereference in node:sqlite DatabaseSync#applyChangeset() via malformed SQLite changesetInformativeNULL Pointer Dereference · high
    44 votes
15. WASI sandbox escape via symlinkPrivilege Escalation · medium
    44 votes
16. Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilledImproper Initialization · high
    43 votes
17. Worker permission bypass via InternalWorker leak in diagnosticsImproper Access Control - Generic · high
    42 votes
18. Incomplete Fix for CVE-2026-21637: OCSPRequest and resumeSession Events Crash Node.js TLS Server via Unhandled Synchronous ExceptionsInformativeUncontrolled Resource Consumption · high
    41 votes
19. Assertion error in node_url.cc via malformed URL format leads to Node.js crashReachable Assertion · medium
    40 votes
20. Windows Device Names Still Allow Path Traversal in UNC Paths After CVE-2025-27210 FixInformativePath Traversal · high
    39 votes
21. HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934)Exploiting Incorrectly Configured SSL/TLS · medium
    37 votes
22. Improper error handling in async cryptographic operations crashes processCryptographic Issues - Generic · high
    37 votes
23. Path traversal by monkey-patching Buffer internalsPath Traversal · high
    36 votes
24. Permission Model bypass: process.report writes (and overwrites) files outside --allow-fs-write pathsImproper Access Control - Generic · low
    35 votes
25. Uncatchable "Maximum call stack size exceeded" error on Node.js via async_hooks leads to process crashes bypassing error handlersImproper Handling of Exceptional Conditions · medium
    35 votes
26. Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()Path Traversal · high
    35 votes
27. Permission model improperly processes UNC pathsPrivilege Escalation · low
    35 votes
28. registry.nodejs.org Subdomain TakeoverMan-in-the-Middle
    35 votes
29. FS Permissions BypassViolation of Secure Design Principles · high
    34 votes
30. fs.futimes() Bypasses Read-Only Permission ModelImproper Access Control - Generic · low
    34 votes
31. Memory leak that enables remote Denial of Service against applications processing TLS client certificatesUncontrolled Resource Consumption · medium
    34 votes
32. Potential HTTP Request Smuggling in nodejsHTTP Request Smuggling · low
    $25034 votes
33. Permission Model: --allow-fs-read/--allow-fs-write radix-tree prefix-boundary over-grantImproper Access Control - Generic · high
    33 votes
34. HTTP/2 sessions never clean up after GOAWAY on invalid protocol errorsUncontrolled Resource Consumption · medium
    33 votes
35. Memory Corruption via TOCTOU Race in SharedArrayBuffer UTF-8 Decode (`StringBytes::Encode`)InformativeTime-of-check Time-of-use (TOCTOU) Race Condition · high
    32 votes
36. Improper Input Validation — HTTP Response Parser Unconditionally Accepts Bare CR in Status LineHTTP Request Smuggling · medium
    30 votes
37. TLS certificate hostname bypass when the IP is written fullwidth digitsImproper Certificate Validation · high
    29 votes
38. Permission Model Bypass via `process.report.writeReport()` Path MisvalidationImproper Access Control - Generic · low
    29 votes
39. Node.js: TLS session reuse can lead to hostname verification bypassMan-in-the-Middle · high
    29 votes
40. Denial of Service by resource exhaustion in fetch() brotli decodingUncontrolled Resource Consumption · medium
    27 votes
41. Node.js: use-after-free in TLSWrapUse After Free · high
    27 votes
42. Unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustionUncontrolled Resource Consumption
    25 votes
43. TLS certificate hostname bypass when the host loosely resolves to an IP addressImproper Certificate Validation · high
    24 votes
44. HTTPS Agent PFX object-array key collision allows mTLS client identity reuse across different per-request certificatesImproper Authentication - Generic · medium
    24 votes
45. Missing AES-GCM Authentication Tag Validation and Improper Deprecation HandlingInformativeMissing Required Cryptographic Step · high
    24 votes
46. Usage of unsafe random function in undici for choosing boundaryUse of Insufficiently Random Values · medium
    24 votes
47. setuid() does not drop all privileges due to io_uringPrivilege Escalation · high
    24 votes
48. Code injection and privilege escalation through Linux capabilitiesPrivilege Escalation · high
    23 votes
49. Null Dereference in X509ToObjectNULL Pointer Dereference · medium
    22 votes
50. Denial of Service via `__proto__` header name in `req.headersDistinct` (Uncaught `TypeError` crashes Node.js process)Uncontrolled Resource Consumption · high
    22 votes
51. Take over subdomain undici.nodejs.org.cdn.cloudflare.netArray Index Underflow · medium
    22 votes
52. Permission Model Bypass: `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`Improper Access Control - Generic · low
    21 votes
53. fs.fchown/fchmod bypasses permission modelImproper Access Control - Generic · low
    20 votes
54. Bypass incomplete fix of CVE-2024-27980Command Injection - Generic · high
    20 votes
55. Permissions can be bypassed via arbitrary code execution through abusing libuv signal pipesInformativePrivilege Escalation
    20 votes
56. Multiple permission model bypasses due to improper path traversal sequence sanitizationPath Traversal · high
    20 votes
57. Improper handling of wildcards in --allow-fs-read and --allow-fs-writeImproper Access Control - Generic · medium
    20 votes
58. Built-in TLS module unexpectedly treats "rejectUnauthorized: undefined" as "rejectUnauthorized: false", disabling all certificate validationImproper Certificate Validation · low
    $15020 votes
59. HashDoS in V8Cryptographic Issues - Generic · medium
    19 votes
60. dns.resolve truncates names containing NUL charImproper Access Control - Generic · high
    18 votes
61. Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatImproper Handling of Unicode Encoding · high
    18 votes
62. Proxy-Authorization header is not cleared in cross-domain redirect in undiciInformation Disclosure · low
    18 votes
63. HTTP Request Smuggling via Content Length ObfuscationHTTP Request Smuggling · medium
    18 votes
64. fs.lstat bypasses permission modelPrivilege Escalation · low
    18 votes
65. Bypass network import restriction via data URLImproper Access Control - Generic · medium
    18 votes
66. HTTP Request Smuggling due to accepting space before colonHTTP Request Smuggling · medium
    $25018 votes
67. Re-entrant `nghttp2_session_mem_send()` during `nghttp2_session_mem_recv()` causes heap-use-after-free in Node.js HTTP/2Use After Free · high
    17 votes
68. HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP ParserHTTP Request Smuggling · low
    16 votes
69. Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgeryCryptographic Issues - Generic · medium
    16 votes
70. Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding)Use of a Broken or Risky Cryptographic Algorithm · medium
    16 votes
71. DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)Improper Access Control - Generic · high
    16 votes
72. Prototype pollution via console.table propertiesModification of Assumed-Immutable Data (MAID) · low
    16 votes
73. Keep-alive socket process a response that was written before the request was sentTime-of-check Time-of-use (TOCTOU) Race Condition · medium
    15 votes
74. Permission Model bypass with fs.realpathSyncImproper Access Control - Generic · low
    15 votes
75. Permission Model Bypass in realpathSync.native Allows File Existence DisclosureInformation Disclosure · low
    15 votes
76. Remotely trigger an assertion on a TLS server with a malformed certificate stringImproper Certificate Validation · critical
    15 votes
77. Malformed HTTP/2 SETTINGS frame leads to reachable assertUncontrolled Resource Consumption · critical
    $25014 votes
78. Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpointsImproper Certificate Validation · medium
    13 votes
79. Node --run POSIX positional argument escaping allows shell command injectionInformativeOS Command Injection · high
    13 votes
80. Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (DoS)Integer Overflow · high
    13 votes
81. GOAWAY HTTP/2 frames cause memory leak outside heapUncontrolled Resource Consumption · medium
    13 votes
82. http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacksUncontrolled Resource Consumption · high
    13 votes
83. Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected)Uncontrolled Resource Consumption · medium
    12 votes
84. HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustionUncontrolled Resource Consumption · high
    12 votes
85. dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A RecordsUncontrolled Resource Consumption · medium
    12 votes
86. Off-by-slash vulnerability in nodejs.org and iojs.orgPath Traversal · medium
    12 votes
87. node:sqlite SQLTagStore Iterator Replay Lets Attacker Re-Execute Victim-Bound Writes IndefinitelyTime-of-check Time-of-use (TOCTOU) Race Condition · medium
    11 votes
88. HTTP Response Queue Poisoning via TOCTOU Race Condition in `http.Agent`Time-of-check Time-of-use (TOCTOU) Race Condition · low
    11 votes
89. fetch with integrity option is too lax when algorithm is specified but hash value is in incorrectViolation of Secure Design Principles
    11 votes
90. CRLF Injection in Nodejs ‘undici’ via hostCRLF Injection · medium
    11 votes
91. Weak randomness in WebCrypto keygenUse of Cryptographically Weak Pseudo-Random Number Generator (PRNG) · high
    11 votes
92. HTTP header values do not have trailing OWS trimmedImproper Input Validation · high
    11 votes
93. url.parse() hostname spoofing via javascript: URIsCross-site Scripting (XSS) - Generic · medium
    11 votes
94. Node.js Permission Model bypass: UDS server bind/listen works without `--allow-net`Improper Access Control - Generic · medium
    10 votes
95. Node Installer Local Privilege Escalation Privilege Escalation · medium
    10 votes
96. Proxy-Authorization header not cleared on cross-origin redirect in undici.requestInsufficiently Protected Credentials · low
    9 votes
97. HTTP Request Smuggling Due To Improper Delimiting of Header FieldsHTTP Request Smuggling · medium
    9 votes
98. Multiple HTTP/2 DOS IssuesUncontrolled Resource Consumption · high
    9 votes
99. Unix domain socket server bypasses --permission network restrictions (incomplete CVE-2026-21636 fix)Improper Access Control - Generic · low
    8 votes
100. HTTP Request Smuggling via Empty headers separated by CRHTTP Request Smuggling · medium
     8 votes