By vendor

Nodejs vulnerabilities

Known CVEs affecting Nodejs products, prioritized by severity, with SEC.co remediation and detection guidance.

17 published vulnerabilities

• CVE-2026-12151HIGH 7.5

  The undici WebSocket client, a widely-used library in Node.js applications, has a vulnerability that allows a malicious or compromised WebSocket server to exhaust memory on the client side. The issue stems from the library's failure to limit the number of WebSocket message fragments—even though each fragment individually respects size limits, an attacker can send hundreds or thousands of small fragments to accumulate unbounded memory usage. This causes the client process to crash due to memory exhaustion, creating a denial-of-service condition. Any application that connects to untrusted WebSocket endpoints is at risk.

• CVE-2026-48615HIGH 7.5

  Node.js has a vulnerability in how it handles errors when proxy connections fail. If you configure Node.js to use a proxy server and include the login credentials directly in the proxy URL, those credentials can leak into error messages. This leaked information may end up in application logs, monitoring systems, or diagnostic tools where unauthorized parties could read it. The vulnerability affects all three currently supported Node.js release lines: versions 22, 24, and 26.

• CVE-2026-48619HIGH 7.5

  Node.js has a vulnerability in how it handles HTTP/2 connections where a malicious server can overwhelm a client by sending an excessive number of ORIGIN frames, causing the client process to consume memory until it crashes. This is a denial-of-service flaw that affects all three currently supported Node.js release lines: versions 22, 24, and 26.

• CVE-2026-48933HIGH 7.5

  Node.js has a vulnerability in its WebCrypto module that can crash the entire process when certain cryptographic encryption operations receive very large inputs—specifically, inputs that are exactly a multiple of 2 gigabytes in size. This affects currently supported versions of Node.js (22, 24, and 26), and an attacker on the network could trigger this denial-of-service condition without authentication.

• CVE-2026-6734HIGH 7.5

  A vulnerability in Node.js undici's Socks5ProxyAgent causes it to reuse a single connection pool across multiple destination origins without validation. This means when an application makes requests to different servers through a proxy, undici incorrectly routes requests intended for one destination through a connection pool established for another destination. The result is that sensitive credentials and data meant for origin B get sent to origin A instead, responses from the wrong server are trusted as legitimate, and HTTPS connections may be downgraded to unencrypted HTTP. This affects applications that use Socks5ProxyAgent (either directly or through the global dispatcher) and communicate with more than one origin. The defect was introduced in version 7.23.0 and persists through version 8.1.0.

• CVE-2026-9675HIGH 7.5

  Undici is a widely-used WebSocket client library for Node.js. A flaw in versions 8.1.0 through 8.4.0 allows a malicious WebSocket server to exhaust memory on the client by sending many small message fragments. While each individual fragment stays within the configured size limit, the attacker can chain fragments together to accumulate data far beyond what the client should accept, eventually forcing the process to run out of memory and crash. This is a denial-of-service vulnerability that affects any application using undici's WebSocket functionality and connecting to a compromised or attacker-controlled server.

• CVE-2026-9697HIGH 7.4

  Undici's ProxyAgent, a popular Node.js HTTP client library, has a configuration flaw affecting SOCKS5 proxies. When you configure the library to use a SOCKS5 proxy and also set custom TLS options (like pinning to your internal certificate authority), those TLS settings are silently ignored. Instead, the library falls back to the default public CA bundle, making it possible for an attacker on the network to intercept and modify HTTPS traffic. This breaks certificate pinning strategies that many organizations rely on for security. The issue affects versions 7.23.0 through 7.27.x in the v7 branch and earlier versions in the v8 branch.

• CVE-2026-48618MEDIUM 6.5

  Node.js versions 22, 24, and 26 contain a TLS hostname validation flaw that exploits a mismatch in how Unicode dot separators are handled during certificate verification. An attacker with valid credentials can craft a certificate with a specially-formatted hostname that passes wildcard validation checks on the resolver side but fails on the verifier side, potentially allowing them to intercept encrypted traffic or bypass intended security boundaries. The vulnerability requires authenticated access to exploit, but the impact on confidentiality is significant.

• CVE-2026-9678MEDIUM 5.9

  Undici, a popular Node.js HTTP client library, has a flaw in its caching mechanism that can cause it to incorrectly store and serve cached responses containing sensitive user data. The vulnerability exists when the cache interceptor is enabled in shared-cache mode and an upstream server uses improperly formatted Cache-Control directives—specifically, field names with surrounding whitespace like ` private="authorization"` instead of the standard `private="authorization"`. Because the parser preserves that whitespace, the library fails to recognize that the response should not be cached, and may serve cached authentication data to subsequent requests, potentially exposing one user's credentials or session information to another user or an unauthenticated caller. This only affects applications that have explicitly enabled shared caching, forward Authorization headers, and receive such malformed directives from upstream servers.

• CVE-2026-9679MEDIUM 5.9

  Undici, a popular Node.js HTTP client library, contains a cookie parsing flaw that incorrectly decodes percent-encoded characters in Set-Cookie headers. When applications use undici's cookie parsing functions and then forward the parsed values into HTTP response headers—a common pattern in proxies, middleware, and server-side rendering frameworks—attackers can inject malicious headers into downstream responses. This enables session hijacking, open redirects, or cache poisoning attacks. The vulnerability affects undici versions 7.0.0 through 7.27.x and 8.0.0 through 8.4.x.

• CVE-2026-48928MEDIUM 5.4

  Node.js has a flaw in how it validates hostnames during mutual TLS (mTLS) authentication. When applications use mTLS across multiple security contexts, the inconsistent hostname matching logic can allow an authenticated user to bypass trust policies they shouldn't have access to. The vulnerability requires the attacker to already have valid credentials, limiting the immediate blast radius, but the trust-policy bypass itself creates a privilege escalation or lateral movement path in zero-trust or multi-tenant environments.

• CVE-2026-48934MEDIUM 4.3

  Node.js contains a flaw in how it validates TLS certificates during secure connections. An authenticated attacker could potentially bypass certificate verification, allowing them to intercept or impersonate HTTPS traffic in environments where they have network or application access. This is not a remote unauthenticated attack—it requires the attacker to already have some level of access to the system or network.

• CVE-2026-11525LOW 3.7

  Undici, a Node.js HTTP client library, incorrectly parses the SameSite attribute in Set-Cookie headers. Instead of validating that the attribute is exactly 'Strict', 'Lax', or 'None' as the HTTP specification requires, undici accepts any value containing one of those words as a substring and silently converts it to the closest match. This means a server sending a malformed cookie like 'SameSite=NoneOfYourBusiness' will be treated as 'None'—the least restrictive setting—potentially weakening the security properties applications expect from SameSite enforcement.

• CVE-2026-48931LOW 3.7

  Node.js has a flaw in how its HTTP Agent handles client-server communication. The vulnerability allows a client to incorrectly accept a server response that arrives before the client has actually sent its request. While the window for exploitation is narrow and requires specific timing conditions, it represents a logic error in the HTTP protocol implementation that could lead to subtle application behavior issues. This affects the three currently supported Node.js release lines.

• CVE-2026-6733LOW 3.7

  Undici, a popular HTTP client library for Node.js, contains a flaw that allows an attacker controlling an upstream web server to inject fake HTTP responses into a reused connection. When a client finishes one request and sends another over the same connection (a performance optimization called keep-alive), the injected response gets mixed up with the legitimate response from the new request. This causes the application to receive and process the wrong response data. The attack requires the attacker to already control or compromise the upstream server the client connects to.

• CVE-2026-48935LOW 3.3

  Node.js has a permission model that allows administrators to restrict file system access using flags like `--allow-fs-read` to declare read-only paths. A flaw in how this Permission API enforces those restrictions lets a local user with low privileges modify file metadata—such as permissions, timestamps, and ownership—on paths that should be read-only. This bypasses the intended security boundary and could allow an unprivileged process to alter files it should not be able to touch.

• CVE-2026-48936LOW 3.3

  Node.js 26 contains a weakness in its Permission API that allows a local attacker to start a server using a Unix domain socket even when the `--allow-net` permission flag has not been granted. This bypasses the intended access control mechanism, potentially allowing unauthorized network binding on the local system. The vulnerability requires local access and is limited in scope—it does not expose confidentiality or availability, but it does undermine the integrity of the permission model by enabling unintended network operations.