Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
296 vulnerabilities found for node by nodejs
CVE-2026-126051 (GCVE-0-2026-126051)
Vulnerability from nvd – Published: 2026-11-11 18:35 – Updated: 2026-11-11 18:35
VLAI
EPSS
VEX
Title
Node.js is vulnerable to a remotely triggerable uncaught exception in TLS servers via deferred handshake callbacks
Summary
A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext(), the corresponding OpenSSL callbacks are deferred, and the deferred code does not handle the underlying socket being destroyed between scheduling and execution. By sending a client hello that reaches the vulnerable path (for example, no SNI together with an OCSP request) followed by padding and a socket FIN, an attacker makes OpenSSL deliver the client hello and the end-of-file in the same tick, so the socket is destroyed before the deferred callback runs and the process raises an uncaught exception instead of emitting an 'error' event. This vulnerability affects Node.js 26.x and 24.x.
Severity
7.5 (High)
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodejs.org/en/blog/vulnerability/november… | vendor-advisory |
| https://cna.openjsf.org/security-advisories.html |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThan": "24.22.3",
"status": "affected",
"version": "24.0.0",
"versionType": "semver"
},
{
"lessThan": "26.13.1",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "pimterry"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "UlisesGascon"
},
{
"lang": "en",
"type": "coordinator",
"value": "aduh95"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the `SNICallback`, `OCSPRequest`, `newSession`, or `resumeSession` hooks, or `server.addContext()`, the corresponding OpenSSL callbacks are deferred, and the deferred code does not handle the underlying socket being destroyed between scheduling and execution. By sending a client hello that reaches the vulnerable path (for example, no SNI together with an OCSP request) followed by padding and a socket FIN, an attacker makes OpenSSL deliver the client hello and the end-of-file in the same tick, so the socket is destroyed before the deferred callback runs and the process raises an uncaught exception instead of emitting an `\u0027error\u0027` event. This vulnerability affects Node.js 26.x and 24.x."
}
],
"value": "A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext(), the corresponding OpenSSL callbacks are deferred, and the deferred code does not handle the underlying socket being destroyed between scheduling and execution. By sending a client hello that reaches the vulnerable path (for example, no SNI together with an OCSP request) followed by padding and a socket FIN, an attacker makes OpenSSL deliver the client hello and the end-of-file in the same tick, so the socket is destroyed before the deferred callback runs and the process raises an uncaught exception instead of emitting an \u0027error\u0027 event. This vulnerability affects Node.js 26.x and 24.x."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:35:45.777Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "Node.js is vulnerable to a remotely triggerable uncaught exception in TLS servers via deferred handshake callbacks",
"x_generator": {
"engine": "nodejs-private/security-release publish-cves"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-126051",
"datePublished": "2026-11-11T18:35:45.777Z",
"dateReserved": "2026-11-10T16:56:10.197Z",
"dateUpdated": "2026-11-11T18:35:45.777Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123877 (GCVE-0-2026-123877)
Vulnerability from nvd – Published: 2026-11-11 18:28 – Updated: 2026-11-11 18:28
VLAI
EPSS
VEX
Title
Node.js is vulnerable to a certificate validation bypass in https.Agent via cross-policy TLS session reuse
Summary
A certificate validation bypass in Node.js https.Agent lets a cached TLS session authenticated under one CA policy be reused by a later request with a stricter policy. https.Agent.prototype.getName() assigns the same Agent and session-cache key to a request that omits ca and one that explicitly supplies ca: [], because an omitted value appends nothing to the key while an empty array stringifies to an empty string. The two policies differ: omitting ca uses the default trust store, while supplying ca replaces it. Since they share a key, a TLS session authenticated under the broader default policy is handed to a new connection made under the later ca: [] policy, and TLS 1.3 session resumption carries the earlier authentication forward, so the second request reports authorized === true and transmits confidential data to a server its own CA policy would reject on a fresh connection. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Severity
6.8 (Medium)
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodejs.org/en/blog/vulnerability/november… | vendor-advisory |
| https://cna.openjsf.org/security-advisories.html |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThan": "22.23.5",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
},
{
"lessThan": "24.22.3",
"status": "affected",
"version": "23.0.0",
"versionType": "semver"
},
{
"lessThan": "26.13.1",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "aegis1337 and mickeyjoe"
},
{
"lang": "en",
"type": "remediation developer",
"value": "mcollina"
},
{
"lang": "en",
"type": "coordinator",
"value": "aduh95"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "A certificate validation bypass in Node.js `https.Agent` lets a cached TLS session authenticated under one CA policy be reused by a later request with a stricter policy. `https.Agent.prototype.getName()` assigns the same Agent and session-cache key to a request that omits `ca` and one that explicitly supplies `ca: []`, because an omitted value appends nothing to the key while an empty array stringifies to an empty string. The two policies differ: omitting `ca` uses the default trust store, while supplying `ca` replaces it. Since they share a key, a TLS session authenticated under the broader default policy is handed to a new connection made under the later `ca: []` policy, and TLS 1.3 session resumption carries the earlier authentication forward, so the second request reports `authorized === true` and transmits confidential data to a server its own CA policy would reject on a fresh connection. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"value": "A certificate validation bypass in Node.js https.Agent lets a cached TLS session authenticated under one CA policy be reused by a later request with a stricter policy. https.Agent.prototype.getName() assigns the same Agent and session-cache key to a request that omits ca and one that explicitly supplies ca: [], because an omitted value appends nothing to the key while an empty array stringifies to an empty string. The two policies differ: omitting ca uses the default trust store, while supplying ca replaces it. Since they share a key, a TLS session authenticated under the broader default policy is handed to a new connection made under the later ca: [] policy, and TLS 1.3 session resumption carries the earlier authentication forward, so the second request reports authorized === true and transmits confidential data to a server its own CA policy would reject on a fresh connection. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:28:38.494Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "Node.js is vulnerable to a certificate validation bypass in https.Agent via cross-policy TLS session reuse",
"x_generator": {
"engine": "nodejs-private/security-release publish-cves"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-123877",
"datePublished": "2026-11-11T18:28:38.494Z",
"dateReserved": "2026-11-06T16:32:30.304Z",
"dateUpdated": "2026-11-11T18:28:38.494Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123875 (GCVE-0-2026-123875)
Vulnerability from nvd – Published: 2026-11-11 18:33 – Updated: 2026-11-11 18:33
VLAI
EPSS
VEX
Title
Node.js is vulnerable to an HTTP/2 denial of service via a NULL pointer dereference when a respondWithFile() download is cancelled
Summary
A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile() or stream.respondWithFD() and the client cancels the request, a StreamPipe used for the transfer is torn down in an order that leaves a NULL pointer which is then dereferenced, aborting the process. No crafted frames are needed, and a handful of cancelled requests against a default file-serving handler is enough. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Severity
5.9 (Medium)
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodejs.org/en/blog/vulnerability/november… | vendor-advisory |
| https://cna.openjsf.org/security-advisories.html |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThan": "22.23.5",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
},
{
"lessThan": "24.22.3",
"status": "affected",
"version": "23.0.0",
"versionType": "semver"
},
{
"lessThan": "26.13.1",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Chris Rohlf in collaboration with Claude and Anthropic Research"
},
{
"lang": "en",
"type": "remediation developer",
"value": "mcollina"
},
{
"lang": "en",
"type": "coordinator",
"value": "aduh95"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with `stream.respondWithFile()` or `stream.respondWithFD()` and the client cancels the request, a `StreamPipe` used for the transfer is torn down in an order that leaves a NULL pointer which is then dereferenced, aborting the process. No crafted frames are needed, and a handful of cancelled requests against a default file-serving handler is enough. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"value": "A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile() or stream.respondWithFD() and the client cancels the request, a StreamPipe used for the transfer is torn down in an order that leaves a NULL pointer which is then dereferenced, aborting the process. No crafted frames are needed, and a handful of cancelled requests against a default file-serving handler is enough. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:33:57.475Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "Node.js is vulnerable to an HTTP/2 denial of service via a NULL pointer dereference when a respondWithFile() download is cancelled",
"x_generator": {
"engine": "nodejs-private/security-release publish-cves"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-123875",
"datePublished": "2026-11-11T18:33:57.475Z",
"dateReserved": "2026-11-06T16:22:28.214Z",
"dateUpdated": "2026-11-11T18:33:57.475Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123874 (GCVE-0-2026-123874)
Vulnerability from nvd – Published: 2026-11-11 18:32 – Updated: 2026-11-11 18:32
VLAI
EPSS
VEX
Title
Node.js is vulnerable to an HTTP/2 use-after-free via respondWithFile() stream reset during a pending write
Summary
A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, when the server serves files with respondWithFile() or respondWithFD(). A client can make the server free an Http2Stream while a write request that points to it is still queued on the socket; when that write completes, the code dereferences and makes a virtual call through the freed object. The only precondition is that the application serves a file with stream.respondWithFile() or stream.respondWithFD(), with default settings otherwise. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).
Severity
7.5 (High)
CWE
- CWE-416 - Use After Free
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodejs.org/en/blog/vulnerability/november… | vendor-advisory |
| https://cna.openjsf.org/security-advisories.html |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThan": "24.22.3",
"status": "affected",
"version": "24.0.0",
"versionType": "semver"
},
{
"lessThan": "26.13.1",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Chris Rohlf in collaboration with Claude and Anthropic Research"
},
{
"lang": "en",
"type": "remediation developer",
"value": "mcollina"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "UlisesGascon"
},
{
"lang": "en",
"type": "coordinator",
"value": "aduh95"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, when the server serves files with `respondWithFile()` or `respondWithFD()`. A client can make the server free an `Http2Stream` while a write request that points to it is still queued on the socket; when that write completes, the code dereferences and makes a virtual call through the freed object. The only precondition is that the application serves a file with `stream.respondWithFile()` or `stream.respondWithFD()`, with default settings otherwise. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0)."
}
],
"value": "A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, when the server serves files with respondWithFile() or respondWithFD(). A client can make the server free an Http2Stream while a write request that points to it is still queued on the socket; when that write completes, the code dereferences and makes a virtual call through the freed object. The only precondition is that the application serves a file with stream.respondWithFile() or stream.respondWithFD(), with default settings otherwise. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0)."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:32:20.292Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "Node.js is vulnerable to an HTTP/2 use-after-free via respondWithFile() stream reset during a pending write",
"x_generator": {
"engine": "nodejs-private/security-release publish-cves"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-123874",
"datePublished": "2026-11-11T18:32:20.292Z",
"dateReserved": "2026-11-06T16:21:26.084Z",
"dateUpdated": "2026-11-11T18:32:20.292Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123872 (GCVE-0-2026-123872)
Vulnerability from nvd – Published: 2026-11-11 18:30 – Updated: 2026-11-11 18:30
VLAI
EPSS
VEX
Title
Node.js is vulnerable to a client certificate authentication bypass via TLS 1.2 renegotiation servername change
Summary
A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiation to reach endpoints it was not authorized for. On a server that applies different client-certificate policies per hostname, for example stricter admin-only client-cert auth on one host and ordinary client-cert auth on another, a client that authenticates for a permitted host can renegotiate the TLS 1.2 connection under a different servername and carry its existing authentication to the protected host, bypassing the stricter policy. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Severity
8.1 (High)
CWE
- CWE-287 - Improper Authentication - Generic
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodejs.org/en/blog/vulnerability/november… | vendor-advisory |
| https://cna.openjsf.org/security-advisories.html |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThan": "22.23.5",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
},
{
"lessThan": "24.22.3",
"status": "affected",
"version": "23.0.0",
"versionType": "semver"
},
{
"lessThan": "26.13.1",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "pimterry"
},
{
"lang": "en",
"type": "remediation developer",
"value": "pimterry"
},
{
"lang": "en",
"type": "coordinator",
"value": "aduh95"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "A client certificate authentication bypass in Node.js TLS lets a client change the `servername` during TLS 1.2 renegotiation to reach endpoints it was not authorized for. On a server that applies different client-certificate policies per hostname, for example stricter admin-only client-cert auth on one host and ordinary client-cert auth on another, a client that authenticates for a permitted host can renegotiate the TLS 1.2 connection under a different `servername` and carry its existing authentication to the protected host, bypassing the stricter policy. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"value": "A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiation to reach endpoints it was not authorized for. On a server that applies different client-certificate policies per hostname, for example stricter admin-only client-cert auth on one host and ordinary client-cert auth on another, a client that authenticates for a permitted host can renegotiate the TLS 1.2 connection under a different servername and carry its existing authentication to the protected host, bypassing the stricter policy. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:30:25.193Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "Node.js is vulnerable to a client certificate authentication bypass via TLS 1.2 renegotiation servername change",
"x_generator": {
"engine": "nodejs-private/security-release publish-cves"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-123872",
"datePublished": "2026-11-11T18:30:25.193Z",
"dateReserved": "2026-11-06T16:19:31.993Z",
"dateUpdated": "2026-11-11T18:30:25.193Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123871 (GCVE-0-2026-123871)
Vulnerability from nvd – Published: 2026-11-11 18:26 – Updated: 2026-11-11 18:26
VLAI
EPSS
VEX
Title
Node.js is vulnerable to proxy credential disclosure via ERR_PROXY_INVALID_CONFIG error messages
Summary
Node.js discloses proxy credentials in ERR_PROXY_INVALID_CONFIG error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js error message and redacted the username and password from ProxyConfig.href, but that fix missed four error paths in the same subsystem, one of them inside the same constructor, which interpolate the raw proxy URL, credentials included, into an ERR_PROXY_INVALID_CONFIG message. The proxy URL comes from the environment, but the defect is the sink: a secret that Node.js redacts everywhere else is emitted verbatim into a much wider audience than the process environment, such as stderr, container logs, log aggregation, and crash reporting services. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Severity
6.2 (Medium)
CWE
- CWE-209 - Information Exposure Through an Error Message
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodejs.org/en/blog/vulnerability/november… | vendor-advisory |
| https://cna.openjsf.org/security-advisories.html |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThan": "22.23.5",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
},
{
"lessThan": "24.22.3",
"status": "affected",
"version": "23.0.0",
"versionType": "semver"
},
{
"lessThan": "26.13.1",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "p-v-p"
},
{
"lang": "en",
"type": "remediation developer",
"value": "mcollina"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Trott"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "UlisesGascon"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "joyeecheung"
},
{
"lang": "en",
"type": "coordinator",
"value": "aduh95"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "Node.js discloses proxy credentials in `ERR_PROXY_INVALID_CONFIG` error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js error message and redacted the username and password from `ProxyConfig.href`, but that fix missed four error paths in the same subsystem, one of them inside the same constructor, which interpolate the raw proxy URL, credentials included, into an `ERR_PROXY_INVALID_CONFIG` message. The proxy URL comes from the environment, but the defect is the sink: a secret that Node.js redacts everywhere else is emitted verbatim into a much wider audience than the process environment, such as stderr, container logs, log aggregation, and crash reporting services. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"value": "Node.js discloses proxy credentials in ERR_PROXY_INVALID_CONFIG error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js error message and redacted the username and password from ProxyConfig.href, but that fix missed four error paths in the same subsystem, one of them inside the same constructor, which interpolate the raw proxy URL, credentials included, into an ERR_PROXY_INVALID_CONFIG message. The proxy URL comes from the environment, but the defect is the sink: a secret that Node.js redacts everywhere else is emitted verbatim into a much wider audience than the process environment, such as stderr, container logs, log aggregation, and crash reporting services. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "Information Exposure Through an Error Message",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:26:51.700Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "Node.js is vulnerable to proxy credential disclosure via ERR_PROXY_INVALID_CONFIG error messages",
"x_generator": {
"engine": "nodejs-private/security-release publish-cves"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-123871",
"datePublished": "2026-11-11T18:26:51.700Z",
"dateReserved": "2026-11-06T16:18:41.667Z",
"dateUpdated": "2026-11-11T18:26:51.700Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123868 (GCVE-0-2026-123868)
Vulnerability from nvd – Published: 2026-11-11 18:25 – Updated: 2026-11-11 18:25
VLAI
EPSS
VEX
Title
Node.js is vulnerable to an HTTP/2 memory exhaustion denial of service via unaccounted inbound DATA on an undrained stream
Summary
An unauthenticated HTTP/2 client can exhaust Node.js server memory because inbound DATA queued on an undrained stream is charged to no session budget. Each inbound DATA frame creates one JavaScript Buffer view in the receiving stream's readable queue, but nothing charges that queue to current_session_memory_: the socket read buffer is accounted only during parsing and released immediately, so whatever stays queued is accounted to nothing. A peer that fills a stream's receive window with one-byte DATA frames pays about 10 wire bytes per frame while the server retains about 114 bytes per frame, so a single stream on one connection can retain hundreds of megabytes from tens of megabytes sent. maxSessionMemory neither bounds the growth nor refuses new streams, because Http2Session::CanAddStream gates admission on the same counter that never sees the queue. This vulnerability affects Node.js 26.x and 24.x.
Severity
5.9 (Medium)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodejs.org/en/blog/vulnerability/november… | vendor-advisory |
| https://cna.openjsf.org/security-advisories.html |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThan": "24.22.3",
"status": "affected",
"version": "24.0.0",
"versionType": "semver"
},
{
"lessThan": "26.13.1",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "jiri1234"
},
{
"lang": "en",
"type": "remediation developer",
"value": "mcollina"
},
{
"lang": "en",
"type": "coordinator",
"value": "aduh95"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "An unauthenticated HTTP/2 client can exhaust Node.js server memory because inbound DATA queued on an undrained stream is charged to no session budget. Each inbound `DATA` frame creates one JavaScript `Buffer` view in the receiving stream\u0027s readable queue, but nothing charges that queue to `current_session_memory_`: the socket read buffer is accounted only during parsing and released immediately, so whatever stays queued is accounted to nothing. A peer that fills a stream\u0027s receive window with one-byte `DATA` frames pays about 10 wire bytes per frame while the server retains about 114 bytes per frame, so a single stream on one connection can retain hundreds of megabytes from tens of megabytes sent. `maxSessionMemory` neither bounds the growth nor refuses new streams, because `Http2Session::CanAddStream` gates admission on the same counter that never sees the queue. This vulnerability affects Node.js 26.x and 24.x."
}
],
"value": "An unauthenticated HTTP/2 client can exhaust Node.js server memory because inbound DATA queued on an undrained stream is charged to no session budget. Each inbound DATA frame creates one JavaScript Buffer view in the receiving stream\u0027s readable queue, but nothing charges that queue to current_session_memory_: the socket read buffer is accounted only during parsing and released immediately, so whatever stays queued is accounted to nothing. A peer that fills a stream\u0027s receive window with one-byte DATA frames pays about 10 wire bytes per frame while the server retains about 114 bytes per frame, so a single stream on one connection can retain hundreds of megabytes from tens of megabytes sent. maxSessionMemory neither bounds the growth nor refuses new streams, because Http2Session::CanAddStream gates admission on the same counter that never sees the queue. This vulnerability affects Node.js 26.x and 24.x."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:25:01.907Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "Node.js is vulnerable to an HTTP/2 memory exhaustion denial of service via unaccounted inbound DATA on an undrained stream",
"x_generator": {
"engine": "nodejs-private/security-release publish-cves"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-123868",
"datePublished": "2026-11-11T18:25:01.907Z",
"dateReserved": "2026-11-06T16:17:16.212Z",
"dateUpdated": "2026-11-11T18:25:01.907Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123867 (GCVE-0-2026-123867)
Vulnerability from nvd – Published: 2026-11-11 18:23 – Updated: 2026-11-11 18:23
VLAI
EPSS
VEX
Title
Node.js is vulnerable to a per-host mTLS authorization bypass via a CA-only SNI context failing open to the default CA
Summary
A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different client-certificate CA with server.addContext(host, { ca: protectedCA }) but no server certificate in that SNI context, the per-host client CA is never installed and the handshake falls back to the default client CA. In src/crypto/crypto_tls.cc, CertCbDone installs the SNI context's CA only when setSniContext succeeds, but setSniContext returns false for a context with no server certificate, so a CA-only SNI context silently keeps the default CA. A client holding a certificate trusted by the default CA, but not the protected CA, can therefore complete mTLS to the protected hostname and read its response even with requestCert and rejectUnauthorized enabled, while a client certified by the protected CA is rejected. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Severity
4.2 (Medium)
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodejs.org/en/blog/vulnerability/november… | vendor-advisory |
| https://cna.openjsf.org/security-advisories.html |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThan": "22.23.5",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
},
{
"lessThan": "24.22.3",
"status": "affected",
"version": "23.0.0",
"versionType": "semver"
},
{
"lessThan": "26.13.1",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "aur0r4_glyph"
},
{
"lang": "en",
"type": "remediation developer",
"value": "mcollina"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "UlisesGascon"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "pimterry"
},
{
"lang": "en",
"type": "coordinator",
"value": "aduh95"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different client-certificate CA with `server.addContext(host, { ca: protectedCA })` but no server certificate in that SNI context, the per-host client CA is never installed and the handshake falls back to the default client CA. In `src/crypto/crypto_tls.cc`, `CertCbDone` installs the SNI context\u0027s CA only when `setSniContext` succeeds, but `setSniContext` returns `false` for a context with no server certificate, so a CA-only SNI context silently keeps the default CA. A client holding a certificate trusted by the default CA, but not the protected CA, can therefore complete mTLS to the protected hostname and read its response even with `requestCert` and `rejectUnauthorized` enabled, while a client certified by the protected CA is rejected. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"value": "A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different client-certificate CA with server.addContext(host, { ca: protectedCA }) but no server certificate in that SNI context, the per-host client CA is never installed and the handshake falls back to the default client CA. In src/crypto/crypto_tls.cc, CertCbDone installs the SNI context\u0027s CA only when setSniContext succeeds, but setSniContext returns false for a context with no server certificate, so a CA-only SNI context silently keeps the default CA. A client holding a certificate trusted by the default CA, but not the protected CA, can therefore complete mTLS to the protected hostname and read its response even with requestCert and rejectUnauthorized enabled, while a client certified by the protected CA is rejected. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:23:12.991Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "Node.js is vulnerable to a per-host mTLS authorization bypass via a CA-only SNI context failing open to the default CA",
"x_generator": {
"engine": "nodejs-private/security-release publish-cves"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-123867",
"datePublished": "2026-11-11T18:23:12.991Z",
"dateReserved": "2026-11-06T16:16:19.081Z",
"dateUpdated": "2026-11-11T18:23:12.991Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123866 (GCVE-0-2026-123866)
Vulnerability from nvd – Published: 2026-11-11 18:21 – Updated: 2026-11-11 18:21
VLAI
EPSS
VEX
Title
Node.js is vulnerable to HTTP/2 response memory disclosure via a use-after-free during stream teardown
Summary
A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connections' response buffers, to a peer. When a stream is torn down while a write is still backpressured, for example by a peer RST_STREAM or by the server's own per-stream timeout destroying the stream, the stream's response buffer is freed but a reference to it is still used, so freed or unrelated heap memory is written to the socket instead of the intended response. On Node.js 26.x and 24.x the teardown can be driven purely by a remote peer once the window-size change from 26.9.0 and 24.22.0 is present, and on all supported lines the same defect is reachable through an application-initiated teardown such as a per-stream idle timeout. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Severity
7.5 (High)
CWE
- CWE-416 - Use After Free
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodejs.org/en/blog/vulnerability/november… | vendor-advisory |
| https://cna.openjsf.org/security-advisories.html |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThan": "22.23.5",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
},
{
"lessThan": "24.22.3",
"status": "affected",
"version": "23.0.0",
"versionType": "semver"
},
{
"lessThan": "26.13.1",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "aidan02"
},
{
"lang": "en",
"type": "remediation developer",
"value": "mcollina"
},
{
"lang": "en",
"type": "coordinator",
"value": "aduh95"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connections\u0027 response buffers, to a peer. When a stream is torn down while a write is still backpressured, for example by a peer `RST_STREAM` or by the server\u0027s own per-stream timeout destroying the stream, the stream\u0027s response buffer is freed but a reference to it is still used, so freed or unrelated heap memory is written to the socket instead of the intended response. On Node.js 26.x and 24.x the teardown can be driven purely by a remote peer once the window-size change from 26.9.0 and 24.22.0 is present, and on all supported lines the same defect is reachable through an application-initiated teardown such as a per-stream idle timeout. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"value": "A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connections\u0027 response buffers, to a peer. When a stream is torn down while a write is still backpressured, for example by a peer RST_STREAM or by the server\u0027s own per-stream timeout destroying the stream, the stream\u0027s response buffer is freed but a reference to it is still used, so freed or unrelated heap memory is written to the socket instead of the intended response. On Node.js 26.x and 24.x the teardown can be driven purely by a remote peer once the window-size change from 26.9.0 and 24.22.0 is present, and on all supported lines the same defect is reachable through an application-initiated teardown such as a per-stream idle timeout. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:21:18.538Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "Node.js is vulnerable to HTTP/2 response memory disclosure via a use-after-free during stream teardown",
"x_generator": {
"engine": "nodejs-private/security-release publish-cves"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-123866",
"datePublished": "2026-11-11T18:21:18.538Z",
"dateReserved": "2026-11-06T16:15:25.978Z",
"dateUpdated": "2026-11-11T18:21:18.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123865 (GCVE-0-2026-123865)
Vulnerability from nvd – Published: 2026-11-11 18:19 – Updated: 2026-11-11 18:19
VLAI
EPSS
VEX
Title
Node.js is vulnerable to an HTTP/2 memory and file-descriptor leak via a protocol error during session shutdown
Summary
An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a peer triggers a protocol error, for example an oversized frame header, while the session is already shutting down, nghttp2 tears the session down internally but Node.js never notices, leaving a dangling session: the socket stays in CLOSE_WAIT and all of Node.js's HTTP/2 state for that connection is held in memory indefinitely, with no further cost to the attacker. The attacker can start the shutdown remotely by sending GOAWAY(NO_ERROR), so it is reliable against default HTTP/2 servers. It is an incomplete-fix case of CVE-2026-48937: that fix detected nghttp2 internal terminations by watching for GOAWAY sent while not shutting down, but missed terminations that arrive while the session is already shutting down. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Severity
7.5 (High)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodejs.org/en/blog/vulnerability/november… | vendor-advisory |
| https://cna.openjsf.org/security-advisories.html |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThan": "22.23.5",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
},
{
"lessThan": "24.22.3",
"status": "affected",
"version": "23.0.0",
"versionType": "semver"
},
{
"lessThan": "26.13.1",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "pimterry"
},
{
"lang": "en",
"type": "remediation developer",
"value": "mcollina"
},
{
"lang": "en",
"type": "coordinator",
"value": "aduh95"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a peer triggers a protocol error, for example an oversized frame header, while the session is already shutting down, `nghttp2` tears the session down internally but Node.js never notices, leaving a dangling session: the socket stays in `CLOSE_WAIT` and all of Node.js\u0027s HTTP/2 state for that connection is held in memory indefinitely, with no further cost to the attacker. The attacker can start the shutdown remotely by sending `GOAWAY(NO_ERROR)`, so it is reliable against default HTTP/2 servers. It is an incomplete-fix case of CVE-2026-48937: that fix detected `nghttp2` internal terminations by watching for `GOAWAY` sent while not shutting down, but missed terminations that arrive while the session is already shutting down. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"value": "An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a peer triggers a protocol error, for example an oversized frame header, while the session is already shutting down, nghttp2 tears the session down internally but Node.js never notices, leaving a dangling session: the socket stays in CLOSE_WAIT and all of Node.js\u0027s HTTP/2 state for that connection is held in memory indefinitely, with no further cost to the attacker. The attacker can start the shutdown remotely by sending GOAWAY(NO_ERROR), so it is reliable against default HTTP/2 servers. It is an incomplete-fix case of CVE-2026-48937: that fix detected nghttp2 internal terminations by watching for GOAWAY sent while not shutting down, but missed terminations that arrive while the session is already shutting down. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:19:36.284Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "Node.js is vulnerable to an HTTP/2 memory and file-descriptor leak via a protocol error during session shutdown",
"x_generator": {
"engine": "nodejs-private/security-release publish-cves"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-123865",
"datePublished": "2026-11-11T18:19:36.284Z",
"dateReserved": "2026-11-06T16:14:27.277Z",
"dateUpdated": "2026-11-11T18:19:36.284Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123864 (GCVE-0-2026-123864)
Vulnerability from nvd – Published: 2026-11-11 18:17 – Updated: 2026-11-11 18:17
VLAI
EPSS
VEX
Title
Node.js is vulnerable to cross-connection memory disclosure via TLS write re-entrancy in the HTTPS request parser
Summary
A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, including TLS private keys and other users' requests. TLSWrap::DoWrite() calls ClearOut() directly when asked to write zero bytes; if that write is issued from JavaScript running inside the HTTP parser's on_body callback, ClearOut() decrypts the next TLS record while the parser is still mid-body, re-entering llhttp_execute() and causing a use-after-free and an out-of-bounds heap read. The server then copies that freed or unrelated heap memory into the response for the request body. Triggering it requires a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-empty chunk, and reading the leaked memory requires any ordinary route that echoes or stores a request body. Cleartext node:http is not affected. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Severity
8.1 (High)
CWE
- CWE-416 - Use After Free
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodejs.org/en/blog/vulnerability/november… | vendor-advisory |
| https://cna.openjsf.org/security-advisories.html |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThan": "22.23.5",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
},
{
"lessThan": "24.22.3",
"status": "affected",
"version": "23.0.0",
"versionType": "semver"
},
{
"lessThan": "26.13.1",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Chris Rohlf in collaboration with Claude and Anthropic Research"
},
{
"lang": "en",
"type": "remediation developer",
"value": "mcollina"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "ShogunPanda"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "pimterry"
},
{
"lang": "en",
"type": "coordinator",
"value": "aduh95"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, including TLS private keys and other users\u0027 requests. `TLSWrap::DoWrite()` calls `ClearOut()` directly when asked to write zero bytes; if that write is issued from JavaScript running inside the HTTP parser\u0027s `on_body` callback, `ClearOut()` decrypts the next TLS record while the parser is still mid-body, re-entering `llhttp_execute()` and causing a use-after-free and an out-of-bounds heap read. The server then copies that freed or unrelated heap memory into the response for the request body. Triggering it requires a handler that calls `res.flushHeaders()` before the request body ends and later calls `res.end()` with a non-empty chunk, and reading the leaked memory requires any ordinary route that echoes or stores a request body. Cleartext `node:http` is not affected. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"value": "A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, including TLS private keys and other users\u0027 requests. TLSWrap::DoWrite() calls ClearOut() directly when asked to write zero bytes; if that write is issued from JavaScript running inside the HTTP parser\u0027s on_body callback, ClearOut() decrypts the next TLS record while the parser is still mid-body, re-entering llhttp_execute() and causing a use-after-free and an out-of-bounds heap read. The server then copies that freed or unrelated heap memory into the response for the request body. Triggering it requires a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-empty chunk, and reading the leaked memory requires any ordinary route that echoes or stores a request body. Cleartext node:http is not affected. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:17:56.773Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "Node.js is vulnerable to cross-connection memory disclosure via TLS write re-entrancy in the HTTPS request parser",
"x_generator": {
"engine": "nodejs-private/security-release publish-cves"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-123864",
"datePublished": "2026-11-11T18:17:56.773Z",
"dateReserved": "2026-11-06T16:13:33.715Z",
"dateUpdated": "2026-11-11T18:17:56.773Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123863 (GCVE-0-2026-123863)
Vulnerability from nvd – Published: 2026-11-11 18:16 – Updated: 2026-11-11 18:16
VLAI
EPSS
VEX
Title
Node.js is vulnerable to a remote HTTP/2 denial of service via a reachable assertion in Http2Session teardown
Summary
A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated header buffers to outlive its session: the stream is removed from the session's stream set but never detached, so when ~Http2Session() runs the memory accounting is nonzero and the CHECK_EQ(current_nghttp2_memory_, 0) assertion fails, terminating the process. The trigger needs only a default http2 server whose handler responds before the request body has ended, which is typical. It is a variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).
Severity
8.2 (High)
CWE
- CWE-617 - Reachable Assertion
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodejs.org/en/blog/vulnerability/november… | vendor-advisory |
| https://cna.openjsf.org/security-advisories.html |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThan": "24.22.3",
"status": "affected",
"version": "24.0.0",
"versionType": "semver"
},
{
"lessThan": "26.13.1",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Chris Rohlf in collaboration with Claude and Anthropic Research"
},
{
"lang": "en",
"type": "remediation developer",
"value": "mcollina"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "UlisesGascon"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "pimterry"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "ronag"
},
{
"lang": "en",
"type": "coordinator",
"value": "aduh95"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an `Http2Stream` that still holds `nghttp2`-allocated header buffers to outlive its session: the stream is removed from the session\u0027s stream set but never detached, so when `~Http2Session()` runs the memory accounting is nonzero and the `CHECK_EQ(current_nghttp2_memory_, 0)` assertion fails, terminating the process. The trigger needs only a default `http2` server whose handler responds before the request body has ended, which is typical. It is a variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0)."
}
],
"value": "A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated header buffers to outlive its session: the stream is removed from the session\u0027s stream set but never detached, so when ~Http2Session() runs the memory accounting is nonzero and the CHECK_EQ(current_nghttp2_memory_, 0) assertion fails, terminating the process. The trigger needs only a default http2 server whose handler responds before the request body has ended, which is typical. It is a variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0)."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-617",
"description": "Reachable Assertion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:16:12.733Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "Node.js is vulnerable to a remote HTTP/2 denial of service via a reachable assertion in Http2Session teardown",
"x_generator": {
"engine": "nodejs-private/security-release publish-cves"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-123863",
"datePublished": "2026-11-11T18:16:12.733Z",
"dateReserved": "2026-11-06T16:12:44.473Z",
"dateUpdated": "2026-11-11T18:16:12.733Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123862 (GCVE-0-2026-123862)
Vulnerability from nvd – Published: 2026-11-11 18:14 – Updated: 2026-11-11 18:14
VLAI
EPSS
VEX
Title
Node.js is vulnerable to a zlib denial of service via a stream destroy during a pending params() call
Summary
An uncatchable exception in the Node.js zlib streaming API lets a peer crash a process by disconnecting while data is being compressed. zlib.params() queues a flush and completes its work in that write's callback; if the stream is destroyed first, as pipeline() does when the peer goes away, Writable still invokes the callback with an error, but the callback ignores its arguments and asserts that the native handle still exists. The handle is gone, so an ERR_INTERNAL_ASSERTION is thrown from inside stream internals and bypasses the stream's error event, the params() callback, and the pipeline() callback, terminating the process. An application is affected only if it calls deflate.params() while streaming to a peer, which is uncommon. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Severity
CWE
- CWE-248 - Uncaught Exception
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodejs.org/en/blog/vulnerability/november… | vendor-advisory |
| https://cna.openjsf.org/security-advisories.html |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThan": "22.23.5",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
},
{
"lessThan": "24.22.3",
"status": "affected",
"version": "23.0.0",
"versionType": "semver"
},
{
"lessThan": "26.13.1",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Chris Rohlf in collaboration with Claude and Anthropic Research"
},
{
"lang": "en",
"type": "remediation developer",
"value": "mcollina"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "UlisesGascon"
},
{
"lang": "en",
"type": "coordinator",
"value": "aduh95"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "An uncatchable exception in the Node.js zlib streaming API lets a peer crash a process by disconnecting while data is being compressed. `zlib.params()` queues a flush and completes its work in that write\u0027s callback; if the stream is destroyed first, as `pipeline()` does when the peer goes away, `Writable` still invokes the callback with an error, but the callback ignores its arguments and asserts that the native handle still exists. The handle is gone, so an `ERR_INTERNAL_ASSERTION` is thrown from inside stream internals and bypasses the stream\u0027s `error` event, the `params()` callback, and the `pipeline()` callback, terminating the process. An application is affected only if it calls `deflate.params()` while streaming to a peer, which is uncommon. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"value": "An uncatchable exception in the Node.js zlib streaming API lets a peer crash a process by disconnecting while data is being compressed. zlib.params() queues a flush and completes its work in that write\u0027s callback; if the stream is destroyed first, as pipeline() does when the peer goes away, Writable still invokes the callback with an error, but the callback ignores its arguments and asserts that the native handle still exists. The handle is gone, so an ERR_INTERNAL_ASSERTION is thrown from inside stream internals and bypasses the stream\u0027s error event, the params() callback, and the pipeline() callback, terminating the process. An application is affected only if it calls deflate.params() while streaming to a peer, which is uncommon. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 2.9,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "Uncaught Exception",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:14:26.996Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "Node.js is vulnerable to a zlib denial of service via a stream destroy during a pending params() call",
"x_generator": {
"engine": "nodejs-private/security-release publish-cves"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-123862",
"datePublished": "2026-11-11T18:14:26.996Z",
"dateReserved": "2026-11-06T16:11:55.196Z",
"dateUpdated": "2026-11-11T18:14:26.996Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123829 (GCVE-0-2026-123829)
Vulnerability from nvd – Published: 2026-11-11 18:12 – Updated: 2026-11-11 18:12
VLAI
EPSS
VEX
Title
Node.js is vulnerable to Permission Model file-name disclosure via recursive fs.watch
Summary
A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch() and fs.promises.watch() in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead only once, on the watched root, and FSEventWrap::OnEvent then forwards every filename libuv reports (relative paths at any depth) to the JavaScript callback without checking that each path is covered by the read grant. Code running under --permission with an exact read grant on a directory can therefore learn names such as sub/secret.txt even though readdir on that subdirectory is denied. The flaw exposes names and timing metadata, not file contents, and requires macOS or Windows plus files created under the watched directory by another actor. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Severity
CWE
- CWE-200 - Information Disclosure
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodejs.org/en/blog/vulnerability/november… | vendor-advisory |
| https://cna.openjsf.org/security-advisories.html |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThan": "22.23.5",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
},
{
"lessThan": "24.22.3",
"status": "affected",
"version": "23.0.0",
"versionType": "semver"
},
{
"lessThan": "26.13.1",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Trail of Bits (OpenAI)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "RafaelGSS"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "UlisesGascon"
},
{
"lang": "en",
"type": "coordinator",
"value": "aduh95"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, `fs.watch()` and `fs.promises.watch()` in recursive mode are backed by the native `libuv` watcher: `FSEventWrap::Start` checks `kFileSystemRead` only once, on the watched root, and `FSEventWrap::OnEvent` then forwards every filename `libuv` reports (relative paths at any depth) to the JavaScript callback without checking that each path is covered by the read grant. Code running under `--permission` with an exact read grant on a directory can therefore learn names such as `sub/secret.txt` even though `readdir` on that subdirectory is denied. The flaw exposes names and timing metadata, not file contents, and requires macOS or Windows plus files created under the watched directory by another actor. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"value": "A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch() and fs.promises.watch() in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead only once, on the watched root, and FSEventWrap::OnEvent then forwards every filename libuv reports (relative paths at any depth) to the JavaScript callback without checking that each path is covered by the read grant. Code running under --permission with an exact read grant on a directory can therefore learn names such as sub/secret.txt even though readdir on that subdirectory is denied. The flaw exposes names and timing metadata, not file contents, and requires macOS or Windows plus files created under the watched directory by another actor. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 2.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:12:41.452Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "Node.js is vulnerable to Permission Model file-name disclosure via recursive fs.watch",
"x_generator": {
"engine": "nodejs-private/security-release publish-cves"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-123829",
"datePublished": "2026-11-11T18:12:41.452Z",
"dateReserved": "2026-11-06T16:03:55.749Z",
"dateUpdated": "2026-11-11T18:12:41.452Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123828 (GCVE-0-2026-123828)
Vulnerability from nvd – Published: 2026-11-11 18:10 – Updated: 2026-11-11 18:10
VLAI
EPSS
VEX
Title
Node.js is vulnerable to a heap buffer overflow in HTTP/2 session.altsvc() via a long origin
Summary
A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling lets a remote, unauthenticated attacker corrupt process memory. When an application passes an attacker-controlled value such as a request's :authority header to Http2Session.altsvc(), the AltSvc implementation in src/node_http2.cc allocates a buffer sized to the origin length and then writes it with a null terminator, placing one byte past the end of the allocation. A single request carrying a long but syntactically valid :authority triggers the out-of-bounds write, which aborts the process and serves as a remote heap-corruption primitive. This vulnerability affects Node.js 26.x and 24.x.
Severity
5.9 (Medium)
CWE
- CWE-122 - Heap Overflow
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodejs.org/en/blog/vulnerability/november… | vendor-advisory |
| https://cna.openjsf.org/security-advisories.html |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThan": "24.22.3",
"status": "affected",
"version": "24.0.0",
"versionType": "semver"
},
{
"lessThan": "26.13.1",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "zonduu"
},
{
"lang": "en",
"type": "remediation developer",
"value": "mcollina"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "UlisesGascon"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "pimterry"
},
{
"lang": "en",
"type": "coordinator",
"value": "aduh95"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling lets a remote, unauthenticated attacker corrupt process memory. When an application passes an attacker-controlled value such as a request\u0027s `:authority` header to `Http2Session.altsvc()`, the AltSvc implementation in `src/node_http2.cc` allocates a buffer sized to the origin length and then writes it with a null terminator, placing one byte past the end of the allocation. A single request carrying a long but syntactically valid `:authority` triggers the out-of-bounds write, which aborts the process and serves as a remote heap-corruption primitive. This vulnerability affects Node.js 26.x and 24.x."
}
],
"value": "A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling lets a remote, unauthenticated attacker corrupt process memory. When an application passes an attacker-controlled value such as a request\u0027s :authority header to Http2Session.altsvc(), the AltSvc implementation in src/node_http2.cc allocates a buffer sized to the origin length and then writes it with a null terminator, placing one byte past the end of the allocation. A single request carrying a long but syntactically valid :authority triggers the out-of-bounds write, which aborts the process and serves as a remote heap-corruption primitive. This vulnerability affects Node.js 26.x and 24.x."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:10:54.030Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "Node.js is vulnerable to a heap buffer overflow in HTTP/2 session.altsvc() via a long origin",
"x_generator": {
"engine": "nodejs-private/security-release publish-cves"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-123828",
"datePublished": "2026-11-11T18:10:54.030Z",
"dateReserved": "2026-11-06T16:02:55.733Z",
"dateUpdated": "2026-11-11T18:10:54.030Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126051 (GCVE-0-2026-126051)
Vulnerability from cvelistv5 – Published: 2026-11-11 18:35 – Updated: 2026-11-11 18:35
VLAI
EPSS
VEX
Title
Node.js is vulnerable to a remotely triggerable uncaught exception in TLS servers via deferred handshake callbacks
Summary
A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext(), the corresponding OpenSSL callbacks are deferred, and the deferred code does not handle the underlying socket being destroyed between scheduling and execution. By sending a client hello that reaches the vulnerable path (for example, no SNI together with an OCSP request) followed by padding and a socket FIN, an attacker makes OpenSSL deliver the client hello and the end-of-file in the same tick, so the socket is destroyed before the deferred callback runs and the process raises an uncaught exception instead of emitting an 'error' event. This vulnerability affects Node.js 26.x and 24.x.
Severity
7.5 (High)
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodejs.org/en/blog/vulnerability/november… | vendor-advisory |
| https://cna.openjsf.org/security-advisories.html |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThan": "24.22.3",
"status": "affected",
"version": "24.0.0",
"versionType": "semver"
},
{
"lessThan": "26.13.1",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "pimterry"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "UlisesGascon"
},
{
"lang": "en",
"type": "coordinator",
"value": "aduh95"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the `SNICallback`, `OCSPRequest`, `newSession`, or `resumeSession` hooks, or `server.addContext()`, the corresponding OpenSSL callbacks are deferred, and the deferred code does not handle the underlying socket being destroyed between scheduling and execution. By sending a client hello that reaches the vulnerable path (for example, no SNI together with an OCSP request) followed by padding and a socket FIN, an attacker makes OpenSSL deliver the client hello and the end-of-file in the same tick, so the socket is destroyed before the deferred callback runs and the process raises an uncaught exception instead of emitting an `\u0027error\u0027` event. This vulnerability affects Node.js 26.x and 24.x."
}
],
"value": "A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext(), the corresponding OpenSSL callbacks are deferred, and the deferred code does not handle the underlying socket being destroyed between scheduling and execution. By sending a client hello that reaches the vulnerable path (for example, no SNI together with an OCSP request) followed by padding and a socket FIN, an attacker makes OpenSSL deliver the client hello and the end-of-file in the same tick, so the socket is destroyed before the deferred callback runs and the process raises an uncaught exception instead of emitting an \u0027error\u0027 event. This vulnerability affects Node.js 26.x and 24.x."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:35:45.777Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "Node.js is vulnerable to a remotely triggerable uncaught exception in TLS servers via deferred handshake callbacks",
"x_generator": {
"engine": "nodejs-private/security-release publish-cves"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-126051",
"datePublished": "2026-11-11T18:35:45.777Z",
"dateReserved": "2026-11-10T16:56:10.197Z",
"dateUpdated": "2026-11-11T18:35:45.777Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123875 (GCVE-0-2026-123875)
Vulnerability from cvelistv5 – Published: 2026-11-11 18:33 – Updated: 2026-11-11 18:33
VLAI
EPSS
VEX
Title
Node.js is vulnerable to an HTTP/2 denial of service via a NULL pointer dereference when a respondWithFile() download is cancelled
Summary
A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile() or stream.respondWithFD() and the client cancels the request, a StreamPipe used for the transfer is torn down in an order that leaves a NULL pointer which is then dereferenced, aborting the process. No crafted frames are needed, and a handful of cancelled requests against a default file-serving handler is enough. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Severity
5.9 (Medium)
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodejs.org/en/blog/vulnerability/november… | vendor-advisory |
| https://cna.openjsf.org/security-advisories.html |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThan": "22.23.5",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
},
{
"lessThan": "24.22.3",
"status": "affected",
"version": "23.0.0",
"versionType": "semver"
},
{
"lessThan": "26.13.1",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Chris Rohlf in collaboration with Claude and Anthropic Research"
},
{
"lang": "en",
"type": "remediation developer",
"value": "mcollina"
},
{
"lang": "en",
"type": "coordinator",
"value": "aduh95"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with `stream.respondWithFile()` or `stream.respondWithFD()` and the client cancels the request, a `StreamPipe` used for the transfer is torn down in an order that leaves a NULL pointer which is then dereferenced, aborting the process. No crafted frames are needed, and a handful of cancelled requests against a default file-serving handler is enough. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"value": "A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile() or stream.respondWithFD() and the client cancels the request, a StreamPipe used for the transfer is torn down in an order that leaves a NULL pointer which is then dereferenced, aborting the process. No crafted frames are needed, and a handful of cancelled requests against a default file-serving handler is enough. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:33:57.475Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "Node.js is vulnerable to an HTTP/2 denial of service via a NULL pointer dereference when a respondWithFile() download is cancelled",
"x_generator": {
"engine": "nodejs-private/security-release publish-cves"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-123875",
"datePublished": "2026-11-11T18:33:57.475Z",
"dateReserved": "2026-11-06T16:22:28.214Z",
"dateUpdated": "2026-11-11T18:33:57.475Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123874 (GCVE-0-2026-123874)
Vulnerability from cvelistv5 – Published: 2026-11-11 18:32 – Updated: 2026-11-11 18:32
VLAI
EPSS
VEX
Title
Node.js is vulnerable to an HTTP/2 use-after-free via respondWithFile() stream reset during a pending write
Summary
A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, when the server serves files with respondWithFile() or respondWithFD(). A client can make the server free an Http2Stream while a write request that points to it is still queued on the socket; when that write completes, the code dereferences and makes a virtual call through the freed object. The only precondition is that the application serves a file with stream.respondWithFile() or stream.respondWithFD(), with default settings otherwise. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).
Severity
7.5 (High)
CWE
- CWE-416 - Use After Free
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodejs.org/en/blog/vulnerability/november… | vendor-advisory |
| https://cna.openjsf.org/security-advisories.html |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThan": "24.22.3",
"status": "affected",
"version": "24.0.0",
"versionType": "semver"
},
{
"lessThan": "26.13.1",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Chris Rohlf in collaboration with Claude and Anthropic Research"
},
{
"lang": "en",
"type": "remediation developer",
"value": "mcollina"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "UlisesGascon"
},
{
"lang": "en",
"type": "coordinator",
"value": "aduh95"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, when the server serves files with `respondWithFile()` or `respondWithFD()`. A client can make the server free an `Http2Stream` while a write request that points to it is still queued on the socket; when that write completes, the code dereferences and makes a virtual call through the freed object. The only precondition is that the application serves a file with `stream.respondWithFile()` or `stream.respondWithFD()`, with default settings otherwise. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0)."
}
],
"value": "A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, when the server serves files with respondWithFile() or respondWithFD(). A client can make the server free an Http2Stream while a write request that points to it is still queued on the socket; when that write completes, the code dereferences and makes a virtual call through the freed object. The only precondition is that the application serves a file with stream.respondWithFile() or stream.respondWithFD(), with default settings otherwise. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0)."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:32:20.292Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "Node.js is vulnerable to an HTTP/2 use-after-free via respondWithFile() stream reset during a pending write",
"x_generator": {
"engine": "nodejs-private/security-release publish-cves"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-123874",
"datePublished": "2026-11-11T18:32:20.292Z",
"dateReserved": "2026-11-06T16:21:26.084Z",
"dateUpdated": "2026-11-11T18:32:20.292Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123872 (GCVE-0-2026-123872)
Vulnerability from cvelistv5 – Published: 2026-11-11 18:30 – Updated: 2026-11-11 18:30
VLAI
EPSS
VEX
Title
Node.js is vulnerable to a client certificate authentication bypass via TLS 1.2 renegotiation servername change
Summary
A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiation to reach endpoints it was not authorized for. On a server that applies different client-certificate policies per hostname, for example stricter admin-only client-cert auth on one host and ordinary client-cert auth on another, a client that authenticates for a permitted host can renegotiate the TLS 1.2 connection under a different servername and carry its existing authentication to the protected host, bypassing the stricter policy. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Severity
8.1 (High)
CWE
- CWE-287 - Improper Authentication - Generic
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodejs.org/en/blog/vulnerability/november… | vendor-advisory |
| https://cna.openjsf.org/security-advisories.html |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThan": "22.23.5",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
},
{
"lessThan": "24.22.3",
"status": "affected",
"version": "23.0.0",
"versionType": "semver"
},
{
"lessThan": "26.13.1",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "pimterry"
},
{
"lang": "en",
"type": "remediation developer",
"value": "pimterry"
},
{
"lang": "en",
"type": "coordinator",
"value": "aduh95"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "A client certificate authentication bypass in Node.js TLS lets a client change the `servername` during TLS 1.2 renegotiation to reach endpoints it was not authorized for. On a server that applies different client-certificate policies per hostname, for example stricter admin-only client-cert auth on one host and ordinary client-cert auth on another, a client that authenticates for a permitted host can renegotiate the TLS 1.2 connection under a different `servername` and carry its existing authentication to the protected host, bypassing the stricter policy. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"value": "A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiation to reach endpoints it was not authorized for. On a server that applies different client-certificate policies per hostname, for example stricter admin-only client-cert auth on one host and ordinary client-cert auth on another, a client that authenticates for a permitted host can renegotiate the TLS 1.2 connection under a different servername and carry its existing authentication to the protected host, bypassing the stricter policy. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:30:25.193Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "Node.js is vulnerable to a client certificate authentication bypass via TLS 1.2 renegotiation servername change",
"x_generator": {
"engine": "nodejs-private/security-release publish-cves"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-123872",
"datePublished": "2026-11-11T18:30:25.193Z",
"dateReserved": "2026-11-06T16:19:31.993Z",
"dateUpdated": "2026-11-11T18:30:25.193Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123877 (GCVE-0-2026-123877)
Vulnerability from cvelistv5 – Published: 2026-11-11 18:28 – Updated: 2026-11-11 18:28
VLAI
EPSS
VEX
Title
Node.js is vulnerable to a certificate validation bypass in https.Agent via cross-policy TLS session reuse
Summary
A certificate validation bypass in Node.js https.Agent lets a cached TLS session authenticated under one CA policy be reused by a later request with a stricter policy. https.Agent.prototype.getName() assigns the same Agent and session-cache key to a request that omits ca and one that explicitly supplies ca: [], because an omitted value appends nothing to the key while an empty array stringifies to an empty string. The two policies differ: omitting ca uses the default trust store, while supplying ca replaces it. Since they share a key, a TLS session authenticated under the broader default policy is handed to a new connection made under the later ca: [] policy, and TLS 1.3 session resumption carries the earlier authentication forward, so the second request reports authorized === true and transmits confidential data to a server its own CA policy would reject on a fresh connection. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Severity
6.8 (Medium)
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodejs.org/en/blog/vulnerability/november… | vendor-advisory |
| https://cna.openjsf.org/security-advisories.html |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThan": "22.23.5",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
},
{
"lessThan": "24.22.3",
"status": "affected",
"version": "23.0.0",
"versionType": "semver"
},
{
"lessThan": "26.13.1",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "aegis1337 and mickeyjoe"
},
{
"lang": "en",
"type": "remediation developer",
"value": "mcollina"
},
{
"lang": "en",
"type": "coordinator",
"value": "aduh95"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "A certificate validation bypass in Node.js `https.Agent` lets a cached TLS session authenticated under one CA policy be reused by a later request with a stricter policy. `https.Agent.prototype.getName()` assigns the same Agent and session-cache key to a request that omits `ca` and one that explicitly supplies `ca: []`, because an omitted value appends nothing to the key while an empty array stringifies to an empty string. The two policies differ: omitting `ca` uses the default trust store, while supplying `ca` replaces it. Since they share a key, a TLS session authenticated under the broader default policy is handed to a new connection made under the later `ca: []` policy, and TLS 1.3 session resumption carries the earlier authentication forward, so the second request reports `authorized === true` and transmits confidential data to a server its own CA policy would reject on a fresh connection. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"value": "A certificate validation bypass in Node.js https.Agent lets a cached TLS session authenticated under one CA policy be reused by a later request with a stricter policy. https.Agent.prototype.getName() assigns the same Agent and session-cache key to a request that omits ca and one that explicitly supplies ca: [], because an omitted value appends nothing to the key while an empty array stringifies to an empty string. The two policies differ: omitting ca uses the default trust store, while supplying ca replaces it. Since they share a key, a TLS session authenticated under the broader default policy is handed to a new connection made under the later ca: [] policy, and TLS 1.3 session resumption carries the earlier authentication forward, so the second request reports authorized === true and transmits confidential data to a server its own CA policy would reject on a fresh connection. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:28:38.494Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "Node.js is vulnerable to a certificate validation bypass in https.Agent via cross-policy TLS session reuse",
"x_generator": {
"engine": "nodejs-private/security-release publish-cves"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-123877",
"datePublished": "2026-11-11T18:28:38.494Z",
"dateReserved": "2026-11-06T16:32:30.304Z",
"dateUpdated": "2026-11-11T18:28:38.494Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123871 (GCVE-0-2026-123871)
Vulnerability from cvelistv5 – Published: 2026-11-11 18:26 – Updated: 2026-11-11 18:26
VLAI
EPSS
VEX
Title
Node.js is vulnerable to proxy credential disclosure via ERR_PROXY_INVALID_CONFIG error messages
Summary
Node.js discloses proxy credentials in ERR_PROXY_INVALID_CONFIG error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js error message and redacted the username and password from ProxyConfig.href, but that fix missed four error paths in the same subsystem, one of them inside the same constructor, which interpolate the raw proxy URL, credentials included, into an ERR_PROXY_INVALID_CONFIG message. The proxy URL comes from the environment, but the defect is the sink: a secret that Node.js redacts everywhere else is emitted verbatim into a much wider audience than the process environment, such as stderr, container logs, log aggregation, and crash reporting services. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Severity
6.2 (Medium)
CWE
- CWE-209 - Information Exposure Through an Error Message
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodejs.org/en/blog/vulnerability/november… | vendor-advisory |
| https://cna.openjsf.org/security-advisories.html |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThan": "22.23.5",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
},
{
"lessThan": "24.22.3",
"status": "affected",
"version": "23.0.0",
"versionType": "semver"
},
{
"lessThan": "26.13.1",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "p-v-p"
},
{
"lang": "en",
"type": "remediation developer",
"value": "mcollina"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Trott"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "UlisesGascon"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "joyeecheung"
},
{
"lang": "en",
"type": "coordinator",
"value": "aduh95"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "Node.js discloses proxy credentials in `ERR_PROXY_INVALID_CONFIG` error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js error message and redacted the username and password from `ProxyConfig.href`, but that fix missed four error paths in the same subsystem, one of them inside the same constructor, which interpolate the raw proxy URL, credentials included, into an `ERR_PROXY_INVALID_CONFIG` message. The proxy URL comes from the environment, but the defect is the sink: a secret that Node.js redacts everywhere else is emitted verbatim into a much wider audience than the process environment, such as stderr, container logs, log aggregation, and crash reporting services. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"value": "Node.js discloses proxy credentials in ERR_PROXY_INVALID_CONFIG error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js error message and redacted the username and password from ProxyConfig.href, but that fix missed four error paths in the same subsystem, one of them inside the same constructor, which interpolate the raw proxy URL, credentials included, into an ERR_PROXY_INVALID_CONFIG message. The proxy URL comes from the environment, but the defect is the sink: a secret that Node.js redacts everywhere else is emitted verbatim into a much wider audience than the process environment, such as stderr, container logs, log aggregation, and crash reporting services. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "Information Exposure Through an Error Message",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:26:51.700Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "Node.js is vulnerable to proxy credential disclosure via ERR_PROXY_INVALID_CONFIG error messages",
"x_generator": {
"engine": "nodejs-private/security-release publish-cves"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-123871",
"datePublished": "2026-11-11T18:26:51.700Z",
"dateReserved": "2026-11-06T16:18:41.667Z",
"dateUpdated": "2026-11-11T18:26:51.700Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123868 (GCVE-0-2026-123868)
Vulnerability from cvelistv5 – Published: 2026-11-11 18:25 – Updated: 2026-11-11 18:25
VLAI
EPSS
VEX
Title
Node.js is vulnerable to an HTTP/2 memory exhaustion denial of service via unaccounted inbound DATA on an undrained stream
Summary
An unauthenticated HTTP/2 client can exhaust Node.js server memory because inbound DATA queued on an undrained stream is charged to no session budget. Each inbound DATA frame creates one JavaScript Buffer view in the receiving stream's readable queue, but nothing charges that queue to current_session_memory_: the socket read buffer is accounted only during parsing and released immediately, so whatever stays queued is accounted to nothing. A peer that fills a stream's receive window with one-byte DATA frames pays about 10 wire bytes per frame while the server retains about 114 bytes per frame, so a single stream on one connection can retain hundreds of megabytes from tens of megabytes sent. maxSessionMemory neither bounds the growth nor refuses new streams, because Http2Session::CanAddStream gates admission on the same counter that never sees the queue. This vulnerability affects Node.js 26.x and 24.x.
Severity
5.9 (Medium)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodejs.org/en/blog/vulnerability/november… | vendor-advisory |
| https://cna.openjsf.org/security-advisories.html |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThan": "24.22.3",
"status": "affected",
"version": "24.0.0",
"versionType": "semver"
},
{
"lessThan": "26.13.1",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "jiri1234"
},
{
"lang": "en",
"type": "remediation developer",
"value": "mcollina"
},
{
"lang": "en",
"type": "coordinator",
"value": "aduh95"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "An unauthenticated HTTP/2 client can exhaust Node.js server memory because inbound DATA queued on an undrained stream is charged to no session budget. Each inbound `DATA` frame creates one JavaScript `Buffer` view in the receiving stream\u0027s readable queue, but nothing charges that queue to `current_session_memory_`: the socket read buffer is accounted only during parsing and released immediately, so whatever stays queued is accounted to nothing. A peer that fills a stream\u0027s receive window with one-byte `DATA` frames pays about 10 wire bytes per frame while the server retains about 114 bytes per frame, so a single stream on one connection can retain hundreds of megabytes from tens of megabytes sent. `maxSessionMemory` neither bounds the growth nor refuses new streams, because `Http2Session::CanAddStream` gates admission on the same counter that never sees the queue. This vulnerability affects Node.js 26.x and 24.x."
}
],
"value": "An unauthenticated HTTP/2 client can exhaust Node.js server memory because inbound DATA queued on an undrained stream is charged to no session budget. Each inbound DATA frame creates one JavaScript Buffer view in the receiving stream\u0027s readable queue, but nothing charges that queue to current_session_memory_: the socket read buffer is accounted only during parsing and released immediately, so whatever stays queued is accounted to nothing. A peer that fills a stream\u0027s receive window with one-byte DATA frames pays about 10 wire bytes per frame while the server retains about 114 bytes per frame, so a single stream on one connection can retain hundreds of megabytes from tens of megabytes sent. maxSessionMemory neither bounds the growth nor refuses new streams, because Http2Session::CanAddStream gates admission on the same counter that never sees the queue. This vulnerability affects Node.js 26.x and 24.x."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:25:01.907Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "Node.js is vulnerable to an HTTP/2 memory exhaustion denial of service via unaccounted inbound DATA on an undrained stream",
"x_generator": {
"engine": "nodejs-private/security-release publish-cves"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-123868",
"datePublished": "2026-11-11T18:25:01.907Z",
"dateReserved": "2026-11-06T16:17:16.212Z",
"dateUpdated": "2026-11-11T18:25:01.907Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123867 (GCVE-0-2026-123867)
Vulnerability from cvelistv5 – Published: 2026-11-11 18:23 – Updated: 2026-11-11 18:23
VLAI
EPSS
VEX
Title
Node.js is vulnerable to a per-host mTLS authorization bypass via a CA-only SNI context failing open to the default CA
Summary
A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different client-certificate CA with server.addContext(host, { ca: protectedCA }) but no server certificate in that SNI context, the per-host client CA is never installed and the handshake falls back to the default client CA. In src/crypto/crypto_tls.cc, CertCbDone installs the SNI context's CA only when setSniContext succeeds, but setSniContext returns false for a context with no server certificate, so a CA-only SNI context silently keeps the default CA. A client holding a certificate trusted by the default CA, but not the protected CA, can therefore complete mTLS to the protected hostname and read its response even with requestCert and rejectUnauthorized enabled, while a client certified by the protected CA is rejected. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Severity
4.2 (Medium)
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodejs.org/en/blog/vulnerability/november… | vendor-advisory |
| https://cna.openjsf.org/security-advisories.html |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThan": "22.23.5",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
},
{
"lessThan": "24.22.3",
"status": "affected",
"version": "23.0.0",
"versionType": "semver"
},
{
"lessThan": "26.13.1",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "aur0r4_glyph"
},
{
"lang": "en",
"type": "remediation developer",
"value": "mcollina"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "UlisesGascon"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "pimterry"
},
{
"lang": "en",
"type": "coordinator",
"value": "aduh95"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different client-certificate CA with `server.addContext(host, { ca: protectedCA })` but no server certificate in that SNI context, the per-host client CA is never installed and the handshake falls back to the default client CA. In `src/crypto/crypto_tls.cc`, `CertCbDone` installs the SNI context\u0027s CA only when `setSniContext` succeeds, but `setSniContext` returns `false` for a context with no server certificate, so a CA-only SNI context silently keeps the default CA. A client holding a certificate trusted by the default CA, but not the protected CA, can therefore complete mTLS to the protected hostname and read its response even with `requestCert` and `rejectUnauthorized` enabled, while a client certified by the protected CA is rejected. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"value": "A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different client-certificate CA with server.addContext(host, { ca: protectedCA }) but no server certificate in that SNI context, the per-host client CA is never installed and the handshake falls back to the default client CA. In src/crypto/crypto_tls.cc, CertCbDone installs the SNI context\u0027s CA only when setSniContext succeeds, but setSniContext returns false for a context with no server certificate, so a CA-only SNI context silently keeps the default CA. A client holding a certificate trusted by the default CA, but not the protected CA, can therefore complete mTLS to the protected hostname and read its response even with requestCert and rejectUnauthorized enabled, while a client certified by the protected CA is rejected. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:23:12.991Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "Node.js is vulnerable to a per-host mTLS authorization bypass via a CA-only SNI context failing open to the default CA",
"x_generator": {
"engine": "nodejs-private/security-release publish-cves"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-123867",
"datePublished": "2026-11-11T18:23:12.991Z",
"dateReserved": "2026-11-06T16:16:19.081Z",
"dateUpdated": "2026-11-11T18:23:12.991Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123866 (GCVE-0-2026-123866)
Vulnerability from cvelistv5 – Published: 2026-11-11 18:21 – Updated: 2026-11-11 18:21
VLAI
EPSS
VEX
Title
Node.js is vulnerable to HTTP/2 response memory disclosure via a use-after-free during stream teardown
Summary
A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connections' response buffers, to a peer. When a stream is torn down while a write is still backpressured, for example by a peer RST_STREAM or by the server's own per-stream timeout destroying the stream, the stream's response buffer is freed but a reference to it is still used, so freed or unrelated heap memory is written to the socket instead of the intended response. On Node.js 26.x and 24.x the teardown can be driven purely by a remote peer once the window-size change from 26.9.0 and 24.22.0 is present, and on all supported lines the same defect is reachable through an application-initiated teardown such as a per-stream idle timeout. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Severity
7.5 (High)
CWE
- CWE-416 - Use After Free
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodejs.org/en/blog/vulnerability/november… | vendor-advisory |
| https://cna.openjsf.org/security-advisories.html |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThan": "22.23.5",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
},
{
"lessThan": "24.22.3",
"status": "affected",
"version": "23.0.0",
"versionType": "semver"
},
{
"lessThan": "26.13.1",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "aidan02"
},
{
"lang": "en",
"type": "remediation developer",
"value": "mcollina"
},
{
"lang": "en",
"type": "coordinator",
"value": "aduh95"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connections\u0027 response buffers, to a peer. When a stream is torn down while a write is still backpressured, for example by a peer `RST_STREAM` or by the server\u0027s own per-stream timeout destroying the stream, the stream\u0027s response buffer is freed but a reference to it is still used, so freed or unrelated heap memory is written to the socket instead of the intended response. On Node.js 26.x and 24.x the teardown can be driven purely by a remote peer once the window-size change from 26.9.0 and 24.22.0 is present, and on all supported lines the same defect is reachable through an application-initiated teardown such as a per-stream idle timeout. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"value": "A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connections\u0027 response buffers, to a peer. When a stream is torn down while a write is still backpressured, for example by a peer RST_STREAM or by the server\u0027s own per-stream timeout destroying the stream, the stream\u0027s response buffer is freed but a reference to it is still used, so freed or unrelated heap memory is written to the socket instead of the intended response. On Node.js 26.x and 24.x the teardown can be driven purely by a remote peer once the window-size change from 26.9.0 and 24.22.0 is present, and on all supported lines the same defect is reachable through an application-initiated teardown such as a per-stream idle timeout. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:21:18.538Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "Node.js is vulnerable to HTTP/2 response memory disclosure via a use-after-free during stream teardown",
"x_generator": {
"engine": "nodejs-private/security-release publish-cves"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-123866",
"datePublished": "2026-11-11T18:21:18.538Z",
"dateReserved": "2026-11-06T16:15:25.978Z",
"dateUpdated": "2026-11-11T18:21:18.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123865 (GCVE-0-2026-123865)
Vulnerability from cvelistv5 – Published: 2026-11-11 18:19 – Updated: 2026-11-11 18:19
VLAI
EPSS
VEX
Title
Node.js is vulnerable to an HTTP/2 memory and file-descriptor leak via a protocol error during session shutdown
Summary
An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a peer triggers a protocol error, for example an oversized frame header, while the session is already shutting down, nghttp2 tears the session down internally but Node.js never notices, leaving a dangling session: the socket stays in CLOSE_WAIT and all of Node.js's HTTP/2 state for that connection is held in memory indefinitely, with no further cost to the attacker. The attacker can start the shutdown remotely by sending GOAWAY(NO_ERROR), so it is reliable against default HTTP/2 servers. It is an incomplete-fix case of CVE-2026-48937: that fix detected nghttp2 internal terminations by watching for GOAWAY sent while not shutting down, but missed terminations that arrive while the session is already shutting down. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Severity
7.5 (High)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodejs.org/en/blog/vulnerability/november… | vendor-advisory |
| https://cna.openjsf.org/security-advisories.html |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThan": "22.23.5",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
},
{
"lessThan": "24.22.3",
"status": "affected",
"version": "23.0.0",
"versionType": "semver"
},
{
"lessThan": "26.13.1",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "pimterry"
},
{
"lang": "en",
"type": "remediation developer",
"value": "mcollina"
},
{
"lang": "en",
"type": "coordinator",
"value": "aduh95"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a peer triggers a protocol error, for example an oversized frame header, while the session is already shutting down, `nghttp2` tears the session down internally but Node.js never notices, leaving a dangling session: the socket stays in `CLOSE_WAIT` and all of Node.js\u0027s HTTP/2 state for that connection is held in memory indefinitely, with no further cost to the attacker. The attacker can start the shutdown remotely by sending `GOAWAY(NO_ERROR)`, so it is reliable against default HTTP/2 servers. It is an incomplete-fix case of CVE-2026-48937: that fix detected `nghttp2` internal terminations by watching for `GOAWAY` sent while not shutting down, but missed terminations that arrive while the session is already shutting down. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"value": "An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a peer triggers a protocol error, for example an oversized frame header, while the session is already shutting down, nghttp2 tears the session down internally but Node.js never notices, leaving a dangling session: the socket stays in CLOSE_WAIT and all of Node.js\u0027s HTTP/2 state for that connection is held in memory indefinitely, with no further cost to the attacker. The attacker can start the shutdown remotely by sending GOAWAY(NO_ERROR), so it is reliable against default HTTP/2 servers. It is an incomplete-fix case of CVE-2026-48937: that fix detected nghttp2 internal terminations by watching for GOAWAY sent while not shutting down, but missed terminations that arrive while the session is already shutting down. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:19:36.284Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "Node.js is vulnerable to an HTTP/2 memory and file-descriptor leak via a protocol error during session shutdown",
"x_generator": {
"engine": "nodejs-private/security-release publish-cves"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-123865",
"datePublished": "2026-11-11T18:19:36.284Z",
"dateReserved": "2026-11-06T16:14:27.277Z",
"dateUpdated": "2026-11-11T18:19:36.284Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123864 (GCVE-0-2026-123864)
Vulnerability from cvelistv5 – Published: 2026-11-11 18:17 – Updated: 2026-11-11 18:17
VLAI
EPSS
VEX
Title
Node.js is vulnerable to cross-connection memory disclosure via TLS write re-entrancy in the HTTPS request parser
Summary
A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, including TLS private keys and other users' requests. TLSWrap::DoWrite() calls ClearOut() directly when asked to write zero bytes; if that write is issued from JavaScript running inside the HTTP parser's on_body callback, ClearOut() decrypts the next TLS record while the parser is still mid-body, re-entering llhttp_execute() and causing a use-after-free and an out-of-bounds heap read. The server then copies that freed or unrelated heap memory into the response for the request body. Triggering it requires a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-empty chunk, and reading the leaked memory requires any ordinary route that echoes or stores a request body. Cleartext node:http is not affected. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Severity
8.1 (High)
CWE
- CWE-416 - Use After Free
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodejs.org/en/blog/vulnerability/november… | vendor-advisory |
| https://cna.openjsf.org/security-advisories.html |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThan": "22.23.5",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
},
{
"lessThan": "24.22.3",
"status": "affected",
"version": "23.0.0",
"versionType": "semver"
},
{
"lessThan": "26.13.1",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Chris Rohlf in collaboration with Claude and Anthropic Research"
},
{
"lang": "en",
"type": "remediation developer",
"value": "mcollina"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "ShogunPanda"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "pimterry"
},
{
"lang": "en",
"type": "coordinator",
"value": "aduh95"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, including TLS private keys and other users\u0027 requests. `TLSWrap::DoWrite()` calls `ClearOut()` directly when asked to write zero bytes; if that write is issued from JavaScript running inside the HTTP parser\u0027s `on_body` callback, `ClearOut()` decrypts the next TLS record while the parser is still mid-body, re-entering `llhttp_execute()` and causing a use-after-free and an out-of-bounds heap read. The server then copies that freed or unrelated heap memory into the response for the request body. Triggering it requires a handler that calls `res.flushHeaders()` before the request body ends and later calls `res.end()` with a non-empty chunk, and reading the leaked memory requires any ordinary route that echoes or stores a request body. Cleartext `node:http` is not affected. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"value": "A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, including TLS private keys and other users\u0027 requests. TLSWrap::DoWrite() calls ClearOut() directly when asked to write zero bytes; if that write is issued from JavaScript running inside the HTTP parser\u0027s on_body callback, ClearOut() decrypts the next TLS record while the parser is still mid-body, re-entering llhttp_execute() and causing a use-after-free and an out-of-bounds heap read. The server then copies that freed or unrelated heap memory into the response for the request body. Triggering it requires a handler that calls res.flushHeaders() before the request body ends and later calls res.end() with a non-empty chunk, and reading the leaked memory requires any ordinary route that echoes or stores a request body. Cleartext node:http is not affected. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:17:56.773Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "Node.js is vulnerable to cross-connection memory disclosure via TLS write re-entrancy in the HTTPS request parser",
"x_generator": {
"engine": "nodejs-private/security-release publish-cves"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-123864",
"datePublished": "2026-11-11T18:17:56.773Z",
"dateReserved": "2026-11-06T16:13:33.715Z",
"dateUpdated": "2026-11-11T18:17:56.773Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123863 (GCVE-0-2026-123863)
Vulnerability from cvelistv5 – Published: 2026-11-11 18:16 – Updated: 2026-11-11 18:16
VLAI
EPSS
VEX
Title
Node.js is vulnerable to a remote HTTP/2 denial of service via a reachable assertion in Http2Session teardown
Summary
A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated header buffers to outlive its session: the stream is removed from the session's stream set but never detached, so when ~Http2Session() runs the memory accounting is nonzero and the CHECK_EQ(current_nghttp2_memory_, 0) assertion fails, terminating the process. The trigger needs only a default http2 server whose handler responds before the request body has ended, which is typical. It is a variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).
Severity
8.2 (High)
CWE
- CWE-617 - Reachable Assertion
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodejs.org/en/blog/vulnerability/november… | vendor-advisory |
| https://cna.openjsf.org/security-advisories.html |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThan": "24.22.3",
"status": "affected",
"version": "24.0.0",
"versionType": "semver"
},
{
"lessThan": "26.13.1",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Chris Rohlf in collaboration with Claude and Anthropic Research"
},
{
"lang": "en",
"type": "remediation developer",
"value": "mcollina"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "UlisesGascon"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "pimterry"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "ronag"
},
{
"lang": "en",
"type": "coordinator",
"value": "aduh95"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an `Http2Stream` that still holds `nghttp2`-allocated header buffers to outlive its session: the stream is removed from the session\u0027s stream set but never detached, so when `~Http2Session()` runs the memory accounting is nonzero and the `CHECK_EQ(current_nghttp2_memory_, 0)` assertion fails, terminating the process. The trigger needs only a default `http2` server whose handler responds before the request body has ended, which is typical. It is a variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0)."
}
],
"value": "A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated header buffers to outlive its session: the stream is removed from the session\u0027s stream set but never detached, so when ~Http2Session() runs the memory accounting is nonzero and the CHECK_EQ(current_nghttp2_memory_, 0) assertion fails, terminating the process. The trigger needs only a default http2 server whose handler responds before the request body has ended, which is typical. It is a variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0)."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-617",
"description": "Reachable Assertion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:16:12.733Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "Node.js is vulnerable to a remote HTTP/2 denial of service via a reachable assertion in Http2Session teardown",
"x_generator": {
"engine": "nodejs-private/security-release publish-cves"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-123863",
"datePublished": "2026-11-11T18:16:12.733Z",
"dateReserved": "2026-11-06T16:12:44.473Z",
"dateUpdated": "2026-11-11T18:16:12.733Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123862 (GCVE-0-2026-123862)
Vulnerability from cvelistv5 – Published: 2026-11-11 18:14 – Updated: 2026-11-11 18:14
VLAI
EPSS
VEX
Title
Node.js is vulnerable to a zlib denial of service via a stream destroy during a pending params() call
Summary
An uncatchable exception in the Node.js zlib streaming API lets a peer crash a process by disconnecting while data is being compressed. zlib.params() queues a flush and completes its work in that write's callback; if the stream is destroyed first, as pipeline() does when the peer goes away, Writable still invokes the callback with an error, but the callback ignores its arguments and asserts that the native handle still exists. The handle is gone, so an ERR_INTERNAL_ASSERTION is thrown from inside stream internals and bypasses the stream's error event, the params() callback, and the pipeline() callback, terminating the process. An application is affected only if it calls deflate.params() while streaming to a peer, which is uncommon. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Severity
CWE
- CWE-248 - Uncaught Exception
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodejs.org/en/blog/vulnerability/november… | vendor-advisory |
| https://cna.openjsf.org/security-advisories.html |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThan": "22.23.5",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
},
{
"lessThan": "24.22.3",
"status": "affected",
"version": "23.0.0",
"versionType": "semver"
},
{
"lessThan": "26.13.1",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Chris Rohlf in collaboration with Claude and Anthropic Research"
},
{
"lang": "en",
"type": "remediation developer",
"value": "mcollina"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "UlisesGascon"
},
{
"lang": "en",
"type": "coordinator",
"value": "aduh95"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "An uncatchable exception in the Node.js zlib streaming API lets a peer crash a process by disconnecting while data is being compressed. `zlib.params()` queues a flush and completes its work in that write\u0027s callback; if the stream is destroyed first, as `pipeline()` does when the peer goes away, `Writable` still invokes the callback with an error, but the callback ignores its arguments and asserts that the native handle still exists. The handle is gone, so an `ERR_INTERNAL_ASSERTION` is thrown from inside stream internals and bypasses the stream\u0027s `error` event, the `params()` callback, and the `pipeline()` callback, terminating the process. An application is affected only if it calls `deflate.params()` while streaming to a peer, which is uncommon. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"value": "An uncatchable exception in the Node.js zlib streaming API lets a peer crash a process by disconnecting while data is being compressed. zlib.params() queues a flush and completes its work in that write\u0027s callback; if the stream is destroyed first, as pipeline() does when the peer goes away, Writable still invokes the callback with an error, but the callback ignores its arguments and asserts that the native handle still exists. The handle is gone, so an ERR_INTERNAL_ASSERTION is thrown from inside stream internals and bypasses the stream\u0027s error event, the params() callback, and the pipeline() callback, terminating the process. An application is affected only if it calls deflate.params() while streaming to a peer, which is uncommon. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 2.9,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "Uncaught Exception",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:14:26.996Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "Node.js is vulnerable to a zlib denial of service via a stream destroy during a pending params() call",
"x_generator": {
"engine": "nodejs-private/security-release publish-cves"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-123862",
"datePublished": "2026-11-11T18:14:26.996Z",
"dateReserved": "2026-11-06T16:11:55.196Z",
"dateUpdated": "2026-11-11T18:14:26.996Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123829 (GCVE-0-2026-123829)
Vulnerability from cvelistv5 – Published: 2026-11-11 18:12 – Updated: 2026-11-11 18:12
VLAI
EPSS
VEX
Title
Node.js is vulnerable to Permission Model file-name disclosure via recursive fs.watch
Summary
A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch() and fs.promises.watch() in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead only once, on the watched root, and FSEventWrap::OnEvent then forwards every filename libuv reports (relative paths at any depth) to the JavaScript callback without checking that each path is covered by the read grant. Code running under --permission with an exact read grant on a directory can therefore learn names such as sub/secret.txt even though readdir on that subdirectory is denied. The flaw exposes names and timing metadata, not file contents, and requires macOS or Windows plus files created under the watched directory by another actor. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Severity
CWE
- CWE-200 - Information Disclosure
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodejs.org/en/blog/vulnerability/november… | vendor-advisory |
| https://cna.openjsf.org/security-advisories.html |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThan": "22.23.5",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
},
{
"lessThan": "24.22.3",
"status": "affected",
"version": "23.0.0",
"versionType": "semver"
},
{
"lessThan": "26.13.1",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Trail of Bits (OpenAI)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "RafaelGSS"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "UlisesGascon"
},
{
"lang": "en",
"type": "coordinator",
"value": "aduh95"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, `fs.watch()` and `fs.promises.watch()` in recursive mode are backed by the native `libuv` watcher: `FSEventWrap::Start` checks `kFileSystemRead` only once, on the watched root, and `FSEventWrap::OnEvent` then forwards every filename `libuv` reports (relative paths at any depth) to the JavaScript callback without checking that each path is covered by the read grant. Code running under `--permission` with an exact read grant on a directory can therefore learn names such as `sub/secret.txt` even though `readdir` on that subdirectory is denied. The flaw exposes names and timing metadata, not file contents, and requires macOS or Windows plus files created under the watched directory by another actor. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"value": "A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch() and fs.promises.watch() in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead only once, on the watched root, and FSEventWrap::OnEvent then forwards every filename libuv reports (relative paths at any depth) to the JavaScript callback without checking that each path is covered by the read grant. Code running under --permission with an exact read grant on a directory can therefore learn names such as sub/secret.txt even though readdir on that subdirectory is denied. The flaw exposes names and timing metadata, not file contents, and requires macOS or Windows plus files created under the watched directory by another actor. This vulnerability affects Node.js 26.x, 24.x, and 22.x."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 2.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:12:41.452Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "Node.js is vulnerable to Permission Model file-name disclosure via recursive fs.watch",
"x_generator": {
"engine": "nodejs-private/security-release publish-cves"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-123829",
"datePublished": "2026-11-11T18:12:41.452Z",
"dateReserved": "2026-11-06T16:03:55.749Z",
"dateUpdated": "2026-11-11T18:12:41.452Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123828 (GCVE-0-2026-123828)
Vulnerability from cvelistv5 – Published: 2026-11-11 18:10 – Updated: 2026-11-11 18:10
VLAI
EPSS
VEX
Title
Node.js is vulnerable to a heap buffer overflow in HTTP/2 session.altsvc() via a long origin
Summary
A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling lets a remote, unauthenticated attacker corrupt process memory. When an application passes an attacker-controlled value such as a request's :authority header to Http2Session.altsvc(), the AltSvc implementation in src/node_http2.cc allocates a buffer sized to the origin length and then writes it with a null terminator, placing one byte past the end of the allocation. A single request carrying a long but syntactically valid :authority triggers the out-of-bounds write, which aborts the process and serves as a remote heap-corruption primitive. This vulnerability affects Node.js 26.x and 24.x.
Severity
5.9 (Medium)
CWE
- CWE-122 - Heap Overflow
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://nodejs.org/en/blog/vulnerability/november… | vendor-advisory |
| https://cna.openjsf.org/security-advisories.html |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThan": "24.22.3",
"status": "affected",
"version": "24.0.0",
"versionType": "semver"
},
{
"lessThan": "26.13.1",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "zonduu"
},
{
"lang": "en",
"type": "remediation developer",
"value": "mcollina"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "UlisesGascon"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "pimterry"
},
{
"lang": "en",
"type": "coordinator",
"value": "aduh95"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling lets a remote, unauthenticated attacker corrupt process memory. When an application passes an attacker-controlled value such as a request\u0027s `:authority` header to `Http2Session.altsvc()`, the AltSvc implementation in `src/node_http2.cc` allocates a buffer sized to the origin length and then writes it with a null terminator, placing one byte past the end of the allocation. A single request carrying a long but syntactically valid `:authority` triggers the out-of-bounds write, which aborts the process and serves as a remote heap-corruption primitive. This vulnerability affects Node.js 26.x and 24.x."
}
],
"value": "A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling lets a remote, unauthenticated attacker corrupt process memory. When an application passes an attacker-controlled value such as a request\u0027s :authority header to Http2Session.altsvc(), the AltSvc implementation in src/node_http2.cc allocates a buffer sized to the origin length and then writes it with a null terminator, placing one byte past the end of the allocation. A single request carrying a long but syntactically valid :authority triggers the out-of-bounds write, which aborts the process and serves as a remote heap-corruption primitive. This vulnerability affects Node.js 26.x and 24.x."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:10:54.030Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "Node.js is vulnerable to a heap buffer overflow in HTTP/2 session.altsvc() via a long origin",
"x_generator": {
"engine": "nodejs-private/security-release publish-cves"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-123828",
"datePublished": "2026-11-11T18:10:54.030Z",
"dateReserved": "2026-11-06T16:02:55.733Z",
"dateUpdated": "2026-11-11T18:10:54.030Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}