nodejs Evented IO for v8 JavaScript

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any nodejs product.

RSS Feeds for nodejs security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in nodejs products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by nodejs Sorted by Most Security Vulnerabilities since 2018

nodejs node.js148 vulnerabilities

nodejs Undici16 vulnerabilities

nodejs9 vulnerabilities

nodejs Elliptic1 vulnerability

Recent nodejs Security Advisories

Advisory	Title	Published
2026-07-21	Monday, July 27, 2026 Security Releases	July 21, 2026
2026-06-09	Wednesday, June 17, 2026 Security Releases	June 9, 2026
march-2026-hashdos	Developing a minimally HashDoS resistant, yet quickly reversible integer hash for V8	March 24, 2026
2026-03-17	Tuesday, March 24, 2026 Security Releases	March 17, 2026
2026-01-28	OpenSSL Security Advisory Assessment, January 2026	January 28, 2026
2026-01-13	Mitigating Denial-of-Service Vulnerability from Unrecoverable Stack Space Exhaustion for React, Next.js, and APM Users	January 13, 2026
2025-12-08	Monday, December 15, 2025 Security Releases	December 8, 2025
2025-07-08	Tuesday, July 15, 2025 Security Releases	July 8, 2025
2025-05-08	Wednesday, May 14, 2025 Security Releases	May 8, 2025
2025-03-31	Node.js Test CI Security Incident	March 31, 2025

By the Year

In 2026 there have been 42 vulnerabilities in nodejs with an average score of 7.1 out of ten. Last year, in 2025 nodejs had 6 security vulnerabilities published. That is, 36 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 3.98.

Year	Vulnerabilities	Average Score
2026	42	7.08
2025	6	3.10
2024	23	6.48
2023	24	6.98
2022	28	7.25
2021	27	7.41
2020	15	8.09
2019	14	5.77
2018	20	6.83

It may take a day or so for new nodejs vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent nodejs Security Vulnerabilities

CVE	Date	Vulnerability
CVE-2026-56848	Aug 04, 2026	Node.js HTTP/2 Re-entrant Heap UAF from nghttp2 A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
CVE-2026-58042	Aug 04, 2026	Node.js DNS resolveAny() Aborts Process on >256 A Records (DoS) A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to denial of service. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
CVE-2026-58045	Aug 04, 2026	Node.js zlib Spoofed TypedArray byteLength Crash (CVE-2026-58045) A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This vulnerability affects Node.js 22.x, 24.x, and 26.x.
CVE-2026-56846	Aug 04, 2026	Node.js HTTP/2 Header Block Memory Exhaustion (CVE-2026-56846) A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js 24.x and 22.x.
CVE-2026-58041	Aug 04, 2026	Node.js node:sqlite Stale SI Reuses Cached PreStmt A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases This vulnerability affects Node.js 22.x, 24.x, and 26.x.
CVE-2026-58044	Aug 04, 2026	Node.js HTTP Client Desync in Forwarding Proxies CVE-2026-58044 A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection. Node.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
CVE-2026-58039	Jul 31, 2026	Node.js Permission Model Flaw: process.report FS Write Bypass A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js 22.x, 24.x, and 26.x.
CVE-2026-58043	Jul 30, 2026	Node.js Permission Model Over-Granting File System Access A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js main, 22.x, 24.x, and 26.x.
CVE-2026-56850	Jul 30, 2026	Node.js HTTPS Agent PFX Key Collision Enables mTLS Identity Reuse A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
CVE-2026-56847	Jul 30, 2026	Node.js Permission Bypass: trace_events.enable() Logs Unrestricted A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js 22.x, 24.x, and 26.x.