Known vulnerabilities in Node.js - page 3

Software: Node.js
Software CPE: cpe:2.3:a:node_js_foundation:nodejs:*:*:*:*:*:*:*:*
Total vulnerabilities: 172
Public exploits: 11
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Node.js Node.js is affected by 172 known vulnerabilities: 11 high, 108 medium, 53 low Critical High Medium Low

Vulnerabilities (172)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU113119 - Resource Management Errors
CVE-2025-27209
CWE-399 Medium
No
No
24.4.1 22.07.2025 SB2025072233
SB2025091525
#VU109243 - Missing release of memory after effective lifetime
CVE-2025-23165
CWE-401 Low
No
No
20.19.2, 22.15.1 16.05.2025 SB2025051605
SB2025051901
SB2025051902
and 16 more
#VU109242 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2025-23167
CWE-444 Medium
Available
No
20.19.2 16.05.2025 SB2025051605
SB2025051901
SB2025051958
and 9 more
#VU109241 - Error Handling
CVE-2025-23166
CWE-388 Medium
No
No
20.19.2, 22.15.1, 23.11.1, 24.0.2 16.05.2025 SB2025051605
SB2025051901
SB2025051902
and 28 more
#VU103225 - Missing release of memory after effective lifetime
CVE-2025-23085
CWE-401 Medium
No
No
18.20.6, 20.18.2, 22.13.1, 23.6.1 22.01.2025 SB2025012252
SB2025012439
SB2025012440
and 29 more
#VU103223 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2025-23084
CWE-22 Low
No
No
18.20.6, 20.18.2, 22.13.1, 23.6.1 22.01.2025 SB2025012252
SB2025012422
SB2025012423
and 11 more
#VU103222 - Permissions, Privileges, and Access Controls
CVE-2025-23083
CWE-264 Low
No
No
20.18.2, 22.13.1, 23.6.1 22.01.2025 SB2025012252
SB2025012346
SB2025012402
and 21 more
#VU93883 - Improper input validation
CVE-2024-37372
CWE-20 Low
No
No
20.15.1, 22.4.1 09.07.2024 SB2024070937
SB20240717120
SB2024072232
and 7 more
#VU93882 - Permissions, Privileges, and Access Controls
CVE-2024-22018
CWE-264 Low
No
No
20.15.1, 22.4.1 09.07.2024 SB2024070937
SB20240717120
SB2024072232
and 15 more
#VU93881 - Permissions, Privileges, and Access Controls
CVE-2024-36137
CWE-264 Low
No
No
20.15.1, 22.4.1 09.07.2024 SB2024070937
SB20240717120
SB2024072232
and 23 more
#VU93880 - Server-Side Request Forgery (SSRF)
CVE-2024-22020
CWE-918 Medium
No
No
18.20.4, 20.15.1, 22.4.1 09.07.2024 SB2024070937
SB2024071636
SB20240717119
and 30 more
#VU93879 - Command injection
CVE-2024-36138
CWE-77 Medium
No
No
18.20.4, 20.15.1, 22.4.1 09.07.2024 SB2024070937
SB2024071636
SB20240717119
and 12 more
#VU88462 - Command injection
CVE-2024-27980
CWE-77 Medium
No
No
18.20.2, 20.12.2, 21.7.3 11.04.2024 SB2024041122
SB2024041155
SB2024041156
and 20 more
#VU88176 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2024-27982
CWE-444 Medium
No
No
18.20.1, 20.12.1, 21.7.2 05.04.2024 SB2024040526
SB2024040851
SB2024040852
and 53 more
#VU88175 - Reachable Assertion
CVE-2024-27983
CWE-617 Medium
Available
No
18.20.1, 20.12.1, 21.7.2 05.04.2024 SB2024040526
SB2024040851
SB2024040852
and 56 more
#VU86728 - Inconsistency Between Implementation and Documented Design
CVE-2024-21890
CWE-1068 Low
No
No
20.11.1, 21.6.2 22.02.2024 SB2024022225
SB2024022226
SB2024022833
and 16 more
#VU86726 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2024-21891
CWE-22 Medium
No
No
20.11.1, 21.6.2 22.02.2024 SB2024022225
SB2024022226
SB2024022833
and 16 more
#VU86724 - Covert Timing Channel
CVE-2023-46809
CWE-385 Medium
No
No
18.19.1, 20.11.1, 21.6.2 22.02.2024 SB2024022225
SB2024022226
SB2024022832
and 35 more
#VU86723 - Improper Privilege Management
CVE-2024-22017
CWE-269 Low
No
No
20.11.1, 21.6.2 22.02.2024 SB2024022225
SB2024022226
SB2024022833
and 16 more
#VU86722 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2024-21896
CWE-22 Medium
No
No
20.11.1, 21.6.2 22.02.2024 SB2024022225
SB2024022226
SB2024022833
and 16 more


Showing elements 41 - 60 out of 172