Node.js version 25.2.1 contains a vulnerability in its permission model that allows Unix Domain Socket (UDS) connections to bypass network restrictions when the --permission flag is enabled. This flaw permits attacker-controlled inputs to connect to arbitrary local sockets even without the --allow-net permission, breaking the intended security boundary. The issue can lead to unauthorized access to privileged local services, potentially resulting in privilege escalation or data exposure. The network permissions feature was still experimental at the time of this vulnerability.
A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
CVE-2025-59464 is a medium severity memory leak vulnerability in Node.js version 24.12.0 affecting its OpenSSL integration. The flaw occurs when converting X.509 certificate fields to UTF-8 during calls to socket.getPeerCertificate(true), where allocated buffers are not freed. Remote clients can exploit this by repeatedly initiating TLS connections, causing steady memory growth and potential resource exhaustion leading to denial of service. No known exploits are currently reported in the wild. The vulnerability requires no authentication but does require user interaction via TLS connections.
A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data corruption. While exploitation typically requires precise timing or in-process code execution, it can become remotely exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality and integrity impact.
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise.
This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
CVE-2026-21637 is a medium severity vulnerability in Node.js TLS error handling affecting multiple versions. It arises when synchronous exceptions thrown in PSK or ALPN callbacks during the TLS handshake bypass normal error handling, causing either immediate process termination or silent resource leaks. Remote attackers can exploit this by sending crafted TLS handshake requests, leading to denial of service through server crashes or resource exhaustion. No authentication or user interaction is required, and the flaw impacts TLS servers using these callbacks. Although no known exploits are reported in the wild yet, the vulnerability affects a wide range of Node.js versions, including recent releases. The CVSS score is 5.9, reflecting a moderate risk primarily to availability. European organizations running Node.
CVE-2026-22036 is a medium severity vulnerability in the Node.js HTTP client library undici, affecting versions prior to 6.23.0 and between 7.0.0 and 7.18.2. The flaw arises from an unbounded decompression chain during HTTP response processing, allowing a malicious server to trigger excessive CPU and memory consumption by inserting thousands of compression steps. This resource exhaustion can lead to denial of service without requiring authentication or user interaction.
An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX.
This vulnerability affects Windows users of `path.join` API.
The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. This implementation re-introduces the HashDoS vulnerability as an attacker who can control the strings to be hashed can generate many hash collisions - an attacker can generate collisions even without knowing the hash-seed.
* This vulnerability affects Node.js v24.x users.
Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.
Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.
