Node.js vulnerabilities

A vulnerability in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths, leading to immediate process termination or silent file descriptor leaks that eventually cause denial of service.

A bug has been identified in Node.js error handling where 'Maximum call stack size exceeded' errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications relying on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.

A memory leak in Node.js's OpenSSL integration occurs when converting X.509 certificate fields to UTF-8 without freeing the allocated buffer. Applications calling socket.getPeerCertificate(true) leak memory per certificate field, allowing remote clients to trigger steady memory growth through repeated TLS connections.

The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs, potentially allowing an adversary to remotely crash a Node.js runtime.

A memory leak occurs in Node.js when a remote peer abruptly closes the socket without sending a GOAWAY notification, or when nghttp2 detects an invalid header and terminates the connection. This can lead to increased memory consumption and potential denial of service.

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API, allowing malicious actors to retrieve stats from files they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.

A flaw in Node.js allows bypassing network import restrictions by embedding non-network imports in data URLs. This enables an attacker to execute arbitrary code and compromise system security.

A critical vulnerability was identified in the HTTP server of the most recent Node version, where malformed headers can lead to HTTP request smuggling. Specifically, placing a space before a content-length header causes it to be misinterpreted, enabling attackers to smuggle a second request within the body of the first.

An attacker can make a Node.js HTTP/2 server completely unavailable by sending a small number of HTTP/2 frame packets. Data can remain in nghttp2 memory after a reset when headers with an HTTP/2 CONTINUATION frame are sent and the client abruptly closes the TCP connection, triggering a race condition.

Node.js versions 4.0.0, 4.1.0, and 4.1.1 allow remote attackers to cause a denial of service.

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to '..' handling was incompatible with the pathname validation used by unspecified community modules.

Node.js versions from 4.0 to 4.8.3, all 5.x versions, and versions 6.0 to 6.11.0, 7.0 to 7.10.0, and 8.0 to 8.1.3 were susceptible to hash flooding DoS attacks. This was due to the HashTable seed being constant across a given released version of Node.js.

The HTTP header parsing code in Node.js in versions 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header.

Node.js versions 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 are vulnerable to HTTP request smuggling attacks via a crafted Content-Length HTTP header.

Node.js versions 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 do not ensure the availability of a parser for each HTTP socket, allowing remote attackers to cause a denial of service via a pipelined HTTP request.

A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request with a header named __proto__ is received and the application accesses req.headersDistinct. The exception is thrown synchronously inside a property getter and cannot be intercepted by error event listeners.

A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution. The issue affects users on version v25.

A flaw in Node.js's Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files.

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20.

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification. Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.

Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect.

All versions of Node.js prior to 6.15.0, 8.14.0, 10.14.0 and 11.3.0 are vulnerable to Slowloris HTTP Denial of Service. An attacker can send headers very slowly, keeping HTTP or HTTPS connections and associated resources alive for a long period of time.

Node.js versions prior to 6.15.0, 8.14.0, 10.14.0, and 11.3.0 are vulnerable to denial of service with large HTTP headers. By combining many requests with maximum-sized headers (almost 80 KB per connection) and carefully timed completion, the HTTP server can abort due to heap allocation failure. Attack potential is mitigated by a load balancer or proxy layer.

Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with `node --debug` or `node debug`, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the debugger on a specific interface, such as `node --debug=localhost`. The debugger was removed in Node.js 8 and replaced with the inspector, so no versions from 8 and later are vulnerable.

Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.

A vulnerability in Node.js before 6.14.4, 8.11.4 and 10.9.0 occurs with UCS-2 encoding (ucs2, ucs-2, utf16le, utf-16le). Buffer#write() can write outside the bounds of a single Buffer when writes start from the second-to-last position, causing a miscalculation of the maximum input byte length.

Calling Buffer.fill() or Buffer.alloc() with certain parameters can cause a hang, resulting in a Denial of Service. All versions of Node.js 6.x, 8.x, and 9.x are vulnerable; 10.x versions are not.

Node.js versions 9.7.0 and later and 10.x are vulnerable (MEDIUM severity). A bug introduced in 9.7.0 increases memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream.

All versions of Node.js 9.x and 10.x are vulnerable (HIGH severity). An attacker can cause a denial of service (DoS) by crashing a Node.js process providing an HTTP server supporting TLS, by sending duplicate/unexpected messages during the handshake.

All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 server in a manner that triggers a cleanup bug where objects are used in native code after they are no longer available. This has been addressed by updating the http2 implementation.

The Node.js inspector in version 6.x and later is vulnerable to a DNS rebinding attack that could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer or another computer with network access to the machine running the Node.js process. A malicious website could use DNS rebinding to bypass same-origin-policy checks and allow HTTP connections to localhost or local network hosts. If a Node.js process with the debug port active is running on localhost or a local network host, the malicious website could connect to it as a debugger and gain full code execution access.

Node.js was affected by an OpenSSL vulnerability (CVE-2017-3737) related to the use of SSL_read() due to TLS handshake failure. An active network attacker could send application data to Node.js, bypassing TLS authentication and encryption.

A vulnerability in Node.js before versions 4.8.5, 6.11.5, and 8.8.0 allows a remote attacker to cause a denial of service (uncaught exception and crash) by leveraging a change in the zlib module 1.2.9 that makes 8 an invalid value for the windowBits parameter.

A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`.

A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync() without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native(). Code running under --permission with restricted --allow-fs-read can still use fs.realpathSync() to check file existence, resolve symlink targets, and enumerate filesystem paths outside permitted directories.

A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`.

A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard --allow-fs-read or --allow-fs-write rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match — e.g. --allow-fs-read=/etc/passwd.* also allows reading /etc/passwd. This requires the wildcard grant to sit directly under the root of the permission tree.

A flaw in the Node.js zlib.ZipFile API can cause it to return bytes that do not belong to the requested entry after local and central header validation fails. When zipEntry.modified is read on an archive whose local header does not match its central directory, the validation error is caught but the parsed local header is left cached without a content offset — a later content read returns attacker-controlled bytes, and CRC-32 verification still passes. A Node.js-based scanner can therefore approve different content from what another ZIP implementation extracts from the same archive.

A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`.

A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`).

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.

A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.

Vulnerability in Node.js HTTP client can cause request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from visible IncomingMessage headers while piping the original body to a reused backend connection.

A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free. This affects Node.js 26.x, 24.x, and 22.x.

A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the synchronous node:zlib APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation can result in a denial of service. Affects Node.js versions 22.x, 24.x, and 26.x.

A flaw in the Node.js HTTP client can cause request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection. Node.js can omit headers beyond `maxHeadersCount`/`maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing, particularly hiding `Content-Length` from userland while the request body is still delivered.

The dns.resolveAny() function in Node.js can abort the process when a DNS response contains more than 256 A records. Repeated triggering can lead to denial of service. Affects Node.js versions 26.x, 24.x, and 22.x.

A vulnerability in Node.js in the node:sqlite module allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements directly using sqlite3_reset(), bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases.

A vulnerability in Node.js HTTP/2 handling allows retained header blocks to bypass maxSessionMemory, potentially leading to remote memory exhaustion. Affects Node.js versions 24.x and 22.x.

Node.js versions 22.x, 24.x, and 26.x have a vulnerability in the Permission Model that allows process.report to write (and overwrite) files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary.