By vendor

Nodejs vulnerabilities

Known CVEs affecting Nodejs products, prioritized by severity, with SEC.co remediation and detection guidance.

2 published vulnerabilities

• CVE-2026-12151HIGH 7.5

  The undici WebSocket client, a widely-used library in Node.js applications, has a vulnerability that allows a malicious or compromised WebSocket server to exhaust memory on the client side. The issue stems from the library's failure to limit the number of WebSocket message fragments—even though each fragment individually respects size limits, an attacker can send hundreds or thousands of small fragments to accumulate unbounded memory usage. This causes the client process to crash due to memory exhaustion, creating a denial-of-service condition. Any application that connects to untrusted WebSocket endpoints is at risk.

• CVE-2026-11525LOW 3.7

  Undici, a Node.js HTTP client library, incorrectly parses the SameSite attribute in Set-Cookie headers. Instead of validating that the attribute is exactly 'Strict', 'Lax', or 'None' as the HTTP specification requires, undici accepts any value containing one of those words as a substring and silently converts it to the closest match. This means a server sending a malformed cookie like 'SameSite=NoneOfYourBusiness' will be treated as 'None'—the least restrictive setting—potentially weakening the security properties applications expect from SameSite enforcement.