https://vulnogram.org/ Most recent CVEs assigned by Node.js (nodejs). https://vulnogram.org/seaview/icons/nodejs.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:08 GMT https://vulnogram.org/CVE-2019-5739 https://vulnogram.org/CVE-2019-5739 Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier… Thu, 28 Mar 2019 16:27:34 GMT https://vulnogram.org/CVE-2019-5737 https://vulnogram.org/CVE-2019-5737 In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly… Thu, 28 Mar 2019 16:20:28 GMT https://vulnogram.org/CVE-2018-12123 https://vulnogram.org/CVE-2018-12123 Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a m… Wed, 28 Nov 2018 17:00:00 GMT https://vulnogram.org/CVE-2018-12122 https://vulnogram.org/CVE-2018-12122 Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources ali… Wed, 28 Nov 2018 17:00:00 GMT https://vulnogram.org/CVE-2018-12121 https://vulnogram.org/CVE-2018-12121 Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of… Wed, 28 Nov 2018 17:00:00 GMT https://vulnogram.org/CVE-2018-12120 https://vulnogram.org/CVE-2018-12120 Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with `node --debug` or `node debug`, it listens to port 5858 on all interfaces by default. This may allow remote compu… Wed, 28 Nov 2018 17:00:00 GMT https://vulnogram.org/CVE-2018-12116 https://vulnogram.org/CVE-2018-12116 Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a secon… Wed, 28 Nov 2018 17:00:00 GMT https://vulnogram.org/CVE-2018-7166 https://vulnogram.org/CVE-2018-7166 In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument specifying `e… Tue, 21 Aug 2018 13:00:00 GMT https://vulnogram.org/CVE-2018-12115 https://vulnogram.org/CVE-2018-12115 In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused to write outside of the bounds of a… Tue, 21 Aug 2018 13:00:00 GMT https://vulnogram.org/CVE-2018-7167 https://vulnogram.org/CVE-2018-7167 Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero… Wed, 13 Jun 2018 16:00:00 GMT https://vulnogram.org/CVE-2018-7164 https://vulnogram.org/CVE-2018-7164 Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker c… Wed, 13 Jun 2018 16:00:00 GMT https://vulnogram.org/CVE-2018-7162 https://vulnogram.org/CVE-2018-7162 All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node process which provides an http server supporting TLS server to crash. This can be accomplished by sending… Wed, 13 Jun 2018 16:00:00 GMT https://vulnogram.org/CVE-2018-7161 https://vulnogram.org/CVE-2018-7161 All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 se… Wed, 13 Jun 2018 16:00:00 GMT https://vulnogram.org/CVE-2018-7160 https://vulnogram.org/CVE-2018-7160 The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer w… Thu, 17 May 2018 14:00:00 GMT https://vulnogram.org/CVE-2018-7159 https://vulnogram.org/CVE-2018-7159 The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Conte… Thu, 17 May 2018 14:00:00 GMT https://vulnogram.org/CVE-2018-7158 https://vulnogram.org/CVE-2018-7158 The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x. T… Thu, 17 May 2018 14:00:00 GMT https://vulnogram.org/CVE-2017-15897 https://vulnogram.org/CVE-2017-15897 Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, "This is not correctly encoded", "hex");' The buffer imp… Mon, 11 Dec 2017 21:00:00 GMT https://vulnogram.org/CVE-2017-15896 https://vulnogram.org/CVE-2017-15896 Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a wa… Mon, 11 Dec 2017 21:00:00 GMT