Vulmon
Recent Vulnerabilities
Product List
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
nodejs node.js vulnerabilities and exploits
(subscribe to this query)
5.8
CVSSv2
CVE-2020-8172
TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.
Nodejs Node.js
Oracle Graalvm 19.3.2
Oracle Graalvm 20.1.0
Oracle Banking Extensibility Workbench 14.4.0
Oracle Banking Extensibility Workbench 14.3.0
Oracle Mysql Cluster
Oracle Blockchain Platform
9.3
CVSSv2
CVE-2016-1669
The Zone::New function in zone.cc in Google V8 prior to 5.0.71.47, as used in Google Chrome prior to 50.0.2661.102, does not properly determine when to expand certain memory allocations, which allows remote malicious users to cause a denial of service (buffer overflow) or possibl...
Debian Debian Linux 8.0
Google Chrome
Opensuse Opensuse 13.1
Google V8
Nodejs Node.js
Canonical Ubuntu Linux 15.10
Canonical Ubuntu Linux 14.04
Canonical Ubuntu Linux 16.04
1 Article
NA
CVE-2022-32213
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).
Llhttp Llhttp
Nodejs Node.js
Fedoraproject Fedora 35
Fedoraproject Fedora 36
Fedoraproject Fedora 37
Siemens Sinec Ins 1.0
Debian Debian Linux 11.0
Stormshield Stormshield Management Center
NA
CVE-2022-32215
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
Nodejs Node.js
Llhttp Llhttp
Fedoraproject Fedora 35
Fedoraproject Fedora 36
Fedoraproject Fedora 37
Siemens Sinec Ins 1.0
Debian Debian Linux 11.0
Stormshield Stormshield Management Center
NA
CVE-2022-32212
A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing ...
Nodejs Node.js
Debian Debian Linux 10.0
Debian Debian Linux 11.0
Fedoraproject Fedora 35
Fedoraproject Fedora 36
Fedoraproject Fedora 37
Siemens Sinec Ins 1.0
Siemens Sinec Ins
10
CVSSv2
CVE-2014-7192
Eval injection vulnerability in index.js in the syntax-error package prior to 1.1.1 for Node.js 0.10.x, as used in IBM Rational Application Developer and other products, allows remote malicious users to execute arbitrary code via a crafted file.
Joyent Node.js
1 EDB exploit
5
CVSSv2
CVE-2018-12116
Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-define...
Nodejs Node.js
Suse Suse Linux Enterprise Server 12
Suse Suse Enterprise Storage 4
Suse Suse Openstack Cloud 7
Suse Suse Openstack Cloud 8
Suse Suse Linux Enterprise Server 15
2 Github repositories
5
CVSSv2
CVE-2018-12122
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time.
Nodejs Node.js
Suse Suse Linux Enterprise Server 12
Suse Suse Enterprise Storage 4
Suse Suse Openstack Cloud 7
Suse Suse Openstack Cloud 8
Suse Suse Linux Enterprise Server 15
1 Github repository
7.5
CVSSv2
CVE-2015-5380
The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js prior to 0.12.6, io.js prior to 1.8.3 and 2.x prior to 2.3.3, and other products, does not verify that there is memory available for a UTF-16 surrogate pair, which allows remote ma...
Google V8 -
Iojs Io.js 2.0.0
Iojs Io.js 2.3.2
Iojs Io.js 2.0.2
Iojs Io.js 2.2.0
Iojs Io.js 2.0.1
Iojs Io.js 2.1.0
Iojs Io.js 2.3.1
Iojs Io.js 2.3.0
Iojs Io.js
Iojs Io.js 2.2.1
Nodejs Node.js
7.5
CVSSv2
CVE-2019-15606
Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons
Nodejs Node.js
Oracle Graalvm 20.0.0
Oracle Graalvm 19.3.1
Oracle Communications Cloud Native Core Network Function Cloud Native Environment 1.4.0
Debian Debian Linux 10.0
Redhat Enterprise Linux 8.0
Redhat Enterprise Linux Eus 8.1
Opensuse Leap 15.1
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
type confusion
IMAP
CVE-2024-36103
CVE-2024-28995
CVE-2024-37325
CVE-2024-30078
CVE-2024-30082
SQL injection
CVE-2024-30052
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
3
4
5
6
7
8
9
10
NEXT »