Vulnerabilidades em nodejs
134 resultadosAnálise Vexday
Node.js apresenta 48 vulnerabilidades catalogadas na base, com 12 divulgadas nos últimos 90 dias, indicando atividade recente de descoberta de falhas. Nenhuma CVE está sob exploração ativa (KEV) nem classificada como crítica, reduzindo o risco imediato. A fraqueza dominante (CWE-284) aponta problemas de controle de acesso, sugerindo que a maior parte dos riscos reside em cenários de escalação de privilégio ou autorização inadequada.
CVE-2024-22025MEDIUMA vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetEPSS 1.3%CVE-2023-24807HIGHUndici vulnerable to Regular Expression Denial of Service in HeadersEPSS 1.3%CVE-2023-46809HIGHNode.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched areEPSS 1.3%CVE-2024-21896HIGHThe permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path isEPSS 1.3%CVE-2024-21891HIGHNode.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-dEPSS 1.2%CVE-2023-45143LOWUndici's cookie header not cleared on cross-origin redirect in fetchEPSS 1.2%CVE-2023-32003MEDIUM`fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack. This flaw arises from EPSS 1.2%CVE-2023-30588—When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs makiEPSS 1.2%CVE-2024-27982MEDIUMThe team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to EPSS 1.2%CVE-2023-23936MEDIUMCRLF Injection in Nodejs ‘undici’ via hostEPSS 1.1%CVE-2023-38552—When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation aEPSS 1.1%CVE-2024-22020MEDIUMA security flaw in Node.js allows a bypass of network import restrictions.
By embedding non-network imports in data URLs, an attacker can eEPSS 1.1%CVE-2024-36138HIGHBypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via childEPSS 1.1%CVE-2026-21637MEDIUMA flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallbaEPSS 1.1%CVE-2023-30581HIGHThe use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.jsoEPSS 1.1%CVE-2024-21890MEDIUMThe Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. EPSS 0.9%CVE-2023-39333MEDIUMMaliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data EPSS 0.9%CVE-2024-22017HIGHsetuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().
This allows the process to performEPSS 0.9%CVE-2025-23166HIGHThe C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background tEPSS 0.8%CVE-2024-30261LOWUndici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrectEPSS 0.8%