Threat Intelligence Database

A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection. Node.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to denial of service. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js **24.x** and **22.x**.

CVE-2026-58039 is a vulnerability in Node.js affecting versions 22.x, 24.x, and 26.x. It involves improper access control in the Node.js permission model, allowing process.report to write or overwrite files outside the intended --allow-fs-write paths. This flaw can lead to confidentiality impacts or bypass of security boundaries under certain configurations. The vulnerability has a low severity rating with a CVSS score of 3.3.

CVE-2026-58040 is a vulnerability in Node.js versions 22.x, 24.x, and 26.x where the HTTPS Agent's TLS session reuse mechanism skips hostname verification across identity policies. This issue is an incomplete fix of a previous vulnerability (CVE-2026-48934). The vulnerability has a medium severity with a CVSS score of 6.3 and does not have any known exploits in the wild at this time.