NO
Product
node
74
CVEs
0
On KEV
10.0
Max CVSS
9
New 30D
Severity mix
Critical 3High 30Medium 26Low 15
Watch
Add node to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-21636 | 10.0 | Jan 20 | A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled Affected: 25.2.1 through 25.2.1 |
| CVE-2026-48930 | 9.8 | Jun 26 | A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings Affected: 22.22.3 through 22.22.3; 24.16.0 through 24.16.0; 26.3.0 through 26.3.0 |
| CVE-2025-55130 | 9.1 | Jan 20 | A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths Affected: 20.19.6 through 20.19.6; 22.21.1 through 22.21.1; 24.12.0 through 24.12.0; 25.2.1 through 25.2.1 |
Showing 3