Known vulnerabilities in Node.js - page 2

Software: Node.js
Software CPE: cpe:2.3:a:node_js_foundation:nodejs:*:*:*:*:*:*:*:*
Total vulnerabilities: 172
Public exploits: 11
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Node.js Node.js is affected by 172 known vulnerabilities: 11 high, 108 medium, 53 low Critical High Medium Low

Vulnerabilities (172)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU135023 - Improper Access Control
CVE-2026-48935
CWE-284 Low
No
No
22.23.0, 24.17.0, 26.3.1 22.06.2026 SB2026062248
SB20260728134
#VU135024 - Improper Access Control
CVE-2026-48936
CWE-284 Low
No
No
22.23.0, 24.17.0, 26.3.1 22.06.2026 SB2026062248
#VU135025 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVE-2026-48931
CWE-367 Medium
No
No
22.23.0, 24.17.0, 26.3.1 22.06.2026 SB2026062248
SB20260728134
#VU126386 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2025-55131
CWE-362 Low
No
No
20.20.0, 22.22.0, 24.13.0, 25.3.0 17.04.2026 SB2026041708
SB2026041712
SB2026041714
and 17 more
#VU126387 - Improper Link Resolution Before File Access ('Link Following')
CVE-2025-55130
CWE-59 Low
No
No
20.20.0, 22.22.0, 24.13.0, 25.3.0 17.04.2026 SB2026041708
SB2026041712
SB2026041714
and 17 more
#VU126388 - Uncaught Exception
CVE-2025-59465
CWE-248 Medium
No
No
20.20.0, 22.22.0, 24.13.0, 25.3.0 17.04.2026 SB2026041708
SB2026041712
SB2026041714
and 20 more
#VU126389 - Uncaught Exception
CVE-2025-59466
CWE-248 Medium
No
No
20.20.0, 22.22.0, 24.13.0, 25.3.0 17.04.2026 SB2026041708
SB2026041712
SB2026041714
and 14 more
#VU126390 - Missing release of memory after effective lifetime
CVE-2025-59464
CWE-401 Medium
No
No
24.12.0 17.04.2026 SB2026041708
SB2026041714
SB2026041715
and 3 more
#VU126391 - Improper Access Control
CVE-2026-21636
CWE-284 Low
No
No
25.3.0 17.04.2026 SB2026041708
SB2026041714
SB2026041715
and 2 more
#VU126392 - Improper Access Control
CVE-2025-55132
CWE-284 Low
No
No
20.20.0, 22.22.0, 24.13.0, 25.3.0 17.04.2026 SB2026041708
SB2026041712
SB2026041714
and 13 more
#VU124546 - Missing release of memory after effective lifetime
CVE-2026-21714
CWE-401 Medium
No
No
20.20.2, 22.22.2, 24.14.1, 25.8.2 25.03.2026 SB20260325154
SB2026032902
SB20260415182
and 19 more
#VU124547 - Creation of chroot Jail Without Changing Working Directory
CVE-2026-21717
CWE-243 Medium
No
No
20.20.2, 22.22.2, 24.14.1, 25.8.2 25.03.2026 SB20260325154
SB2026032902
SB20260415182
and 16 more
#VU124548 - Improper Access Control
CVE-2026-21715
CWE-284 Low
No
No
20.20.2, 22.22.2, 24.14.1, 25.8.2 25.03.2026 SB20260325154
SB2026032902
SB2026041564
and 17 more
#VU124549 - Improper Access Control
CVE-2026-21716
CWE-284 Low
No
No
20.20.2, 22.22.2, 24.14.1, 25.8.2 25.03.2026 SB20260325154
SB2026032902
SB20260415182
and 17 more
#VU124541 - DEPRECATED: Often Misused: Path Manipulation
CVE-2026-21637
CWE-249 High
No
No
20.20.0, 22.22.0, 24.13.0, 25.3.0 25.03.2026 SB2026032902
SB20260415182
SB20260415187
and 25 more
#VU124542 - Error Handling
CVE-2026-21710
CWE-388 Medium
No
No
20.20.2, 22.22.2, 24.14.1, 25.8.2 25.03.2026 SB20260325154
SB2026032902
SB2026041056
and 28 more
#VU124543 - Improper Access Control
CVE-2026-21711
CWE-284 Low
No
No
25.8.2 25.03.2026 SB20260325154
SB20260424153
SB20260424154
#VU124544 - Reachable Assertion
CVE-2026-21712
CWE-617 Medium
No
No
24.14.1, 25.8.2 25.03.2026 SB20260325154
SB2026041725
SB20260424153
and 1 more
#VU124545 - Information Exposure Through Timing Discrepancy
CVE-2026-21713
CWE-208 Medium
No
No
20.20.2, 22.22.2, 24.14.1, 25.8.2 25.03.2026 SB20260325154
SB2026032902
SB2026041543
and 18 more
#VU113118 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2025-27210
CWE-22 Low
Available
No
20.19.4, 22.17.1, 24.4.1 22.07.2025 SB2025072233
SB2025082103
SB2025091525
and 6 more


Showing elements 21 - 40 out of 172