The Node.js Project Node.js
16 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2018-12123 | All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0 | Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Nod | MEDIUM 4.3 | 4.0 % | ||
| CVE-2018-12122 | All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0 | Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial | HIGH 7.5 | 41 % | ||
| CVE-2018-12121 | All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0 | Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination | HIGH 7.5 | 10 % | ||
| CVE-2018-12120 | All versions prior to Node.js 6.15.0 | Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with `no | HIGH 8.1 | 4.3 % | ||
| CVE-2018-12116 | All versions prior to Node.js 6.15.0 and 8.14.0 | Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provid | HIGH 7.5 | 4.6 % | ||
| CVE-2018-7166 | All versions of Node.js 10 prior to 10.9.0 | In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This m | HIGH 7.5 | 3.3 % | ||
| CVE-2018-12115 | All versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 | In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, | HIGH 7.5 | 7.8 % | ||
| CVE-2018-7167 | 6.x+ ; 8.x+ ; 9.x+ ; … | Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to addre | HIGH 7.5 | 6.7 % | ||
| CVE-2018-7164 | 9.7.X+ ; 10.x+ | Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed | HIGH 7.5 | 6.2 % | ||
| CVE-2018-7162 | 9.x+ ; 10.x+ | All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a n | HIGH 7.5 | 6.6 % | ||
| CVE-2018-7161 | 8.x+ ; 9.x+ ; 10.x+ | All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causi | HIGH 7.5 | 7.5 % | ||
| CVE-2018-7160 | ^6.0.0 || ^8.0.0 || ^9.0.0 | The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. A | HIGH 8.8 | 9.5 % | ||
| CVE-2018-7159 | 4.x ; 6.x ; 8.x ; … | The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 | MEDIUM 5.3 | 3.5 % | ||
| CVE-2018-7158 | 4.x | The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in qu | HIGH 7.5 | 3.4 % | ||
| CVE-2017-15897 | 8.0 and higher ; 9.0 and higher | Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the | LOW 3.1 | 2.3 % | ||
| CVE-2017-15896 | 4.0.0 and higher ; 6.0.0 and higher ; 8.0.0 and higher ; … | Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was | CRITICAL 9.1 | 2.4 % |