Browse / Node.js

Node.js

See its reports on the map

What gets reported to Node.js

• Access Control33
• Denial of Service24
• Cryptography22
• Injection and Smuggling21
• Memory Corruption18
• Path Traversal7

Most upvoted reports

AllValidInformativeN/ADuplicate

1. CWE-195 in ExternalMemoryAccounter::Increase()Informative
   55 votes
2. NULL pointer dereference in node:sqlite DatabaseSync#applyChangeset() via malformed SQLite changesetInformativeNULL Pointer Dereference · high
   44 votes
3. Incomplete Fix for CVE-2026-21637: OCSPRequest and resumeSession Events Crash Node.js TLS Server via Unhandled Synchronous ExceptionsInformativeUncontrolled Resource Consumption · high
   41 votes
4. Windows Device Names Still Allow Path Traversal in UNC Paths After CVE-2025-27210 FixInformativePath Traversal · high
   39 votes
5. Memory Corruption via TOCTOU Race in SharedArrayBuffer UTF-8 Decode (`StringBytes::Encode`)InformativeTime-of-check Time-of-use (TOCTOU) Race Condition · high
   32 votes
6. Missing AES-GCM Authentication Tag Validation and Improper Deprecation HandlingInformativeMissing Required Cryptographic Step · high
   24 votes
7. Permissions can be bypassed via arbitrary code execution through abusing libuv signal pipesInformativePrivilege Escalation
   20 votes
8. Node --run POSIX positional argument escaping allows shell command injectionInformativeOS Command Injection · high
   13 votes
9. Child process environment injection via prototype pollutionInformativeCode Injection
   3 votes
10. Hostname spoofingInformativeViolation of Secure Design Principles
    3 votes
11. CRLF Injection in legacy url API (url.parse().hostname)InformativeCRLF Injection · medium
    2 votes
12. Use After Free in crypto.randomFillInformativeUse After Free
    2 votes
13. Http response is not ended although underlying socket is already destroyedInformativeUncontrolled Resource Consumption
    1 votes