A vulnerability in the Node.js permission model for network enforcement allows Unix Domain Socket (UDS) server operations to bypass intended security restrictions. This flaw affects Microsoft product version 3.0. A patch is available to address this issue.
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
Node.js version 25.2.1 contains a vulnerability in its permission model that allows Unix Domain Socket (UDS) connections to bypass network restrictions when the --permission flag is enabled. This flaw permits attacker-controlled inputs to connect to arbitrary local sockets even without the --allow-net permission, breaking the intended security boundary. The issue can lead to unauthorized access to privileged local services, potentially resulting in privilege escalation or data exposure. The network permissions feature was still experimental at the time of this vulnerability.
A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
CVE-2025-59464 is a medium severity memory leak vulnerability in Node.js version 24.12.0 affecting its OpenSSL integration. The flaw occurs when converting X.509 certificate fields to UTF-8 during calls to socket.getPeerCertificate(true), where allocated buffers are not freed. Remote clients can exploit this by repeatedly initiating TLS connections, causing steady memory growth and potential resource exhaustion leading to denial of service. No known exploits are currently reported in the wild. The vulnerability requires no authentication but does require user interaction via TLS connections.
CVE-2026-21637 is a medium severity vulnerability in Node.js TLS error handling affecting multiple versions. It arises when synchronous exceptions thrown in PSK or ALPN callbacks during the TLS handshake bypass normal error handling, causing either immediate process termination or silent resource leaks. Remote attackers can exploit this by sending crafted TLS handshake requests, leading to denial of service through server crashes or resource exhaustion. No authentication or user interaction is required, and the flaw impacts TLS servers using these callbacks. Although no known exploits are reported in the wild yet, the vulnerability affects a wide range of Node.js versions, including recent releases. The CVSS score is 5.9, reflecting a moderate risk primarily to availability. European organizations running Node.
An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX.
This vulnerability affects Windows users of `path.join` API.
The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. This implementation re-introduces the HashDoS vulnerability as an attacker who can control the strings to be hashed can generate many hash collisions - an attacker can generate collisions even without knowing the hash-seed.
* This vulnerability affects Node.js v24.x users.
CVE-2024-27983 is a race condition vulnerability in the Node.js HTTP/2 server. An attacker can cause a denial of service by sending a small number of HTTP/2 frames, including CONTINUATION frames, and then abruptly closing the TCP connection. This triggers a race condition in the Http2Session destructor, leaving data in memory and making the server unavailable.